xmrig | 094ece3d40e61cabe5153091a250abd3ca535c776740454e918157f3e5678031

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
Size

2.3MB
MD5

86f17bb7e44f593c81fa13aa6b985fc0
SHA1

cebdf62f9d69c29937f319278baab36a6290f7e2
SHA256

094ece3d40e61cabe5153091a250abd3ca535c776740454e918157f3e5678031
SHA512

3a0b1cfc151f642b96ded16b80c7f38ada88b48d9e16fd288cfd85ec2c42105958510d07c67284e9585f7d9c0efd18cbf3a9e8f1ae7a30160a1cbd0faa1355ee
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A4VBqxGLI9eR:BemTLkNdfE0pZrN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/660-0-0x00007FF743E70000-0x00007FF7441C4000-memory.dmp	xmrig
behavioral2/files/0x000900000002341d-5.dat	xmrig
behavioral2/files/0x000700000002342c-9.dat	xmrig
behavioral2/files/0x000700000002342d-19.dat	xmrig
behavioral2/files/0x000700000002342f-25.dat	xmrig
behavioral2/files/0x0007000000023431-35.dat	xmrig
behavioral2/files/0x0007000000023433-46.dat	xmrig
behavioral2/files/0x0007000000023435-55.dat	xmrig
behavioral2/files/0x0007000000023436-63.dat	xmrig
behavioral2/files/0x000700000002343e-98.dat	xmrig
behavioral2/files/0x0007000000023440-116.dat	xmrig
behavioral2/files/0x0007000000023447-149.dat	xmrig
behavioral2/memory/2476-678-0x00007FF7E2A40000-0x00007FF7E2D94000-memory.dmp	xmrig
behavioral2/memory/4436-679-0x00007FF65E060000-0x00007FF65E3B4000-memory.dmp	xmrig
behavioral2/memory/2984-680-0x00007FF6718A0000-0x00007FF671BF4000-memory.dmp	xmrig
behavioral2/memory/3788-681-0x00007FF78B780000-0x00007FF78BAD4000-memory.dmp	xmrig
behavioral2/memory/4092-682-0x00007FF7F9EE0000-0x00007FF7FA234000-memory.dmp	xmrig
behavioral2/memory/1360-684-0x00007FF630250000-0x00007FF6305A4000-memory.dmp	xmrig
behavioral2/memory/4508-685-0x00007FF63BE80000-0x00007FF63C1D4000-memory.dmp	xmrig
behavioral2/memory/744-686-0x00007FF79A690000-0x00007FF79A9E4000-memory.dmp	xmrig
behavioral2/memory/2084-683-0x00007FF681BF0000-0x00007FF681F44000-memory.dmp	xmrig
behavioral2/memory/3228-687-0x00007FF743610000-0x00007FF743964000-memory.dmp	xmrig
behavioral2/memory/2876-688-0x00007FF746900000-0x00007FF746C54000-memory.dmp	xmrig
behavioral2/memory/4584-698-0x00007FF63B3C0000-0x00007FF63B714000-memory.dmp	xmrig
behavioral2/memory/2012-704-0x00007FF71B7E0000-0x00007FF71BB34000-memory.dmp	xmrig
behavioral2/memory/4568-753-0x00007FF6CF990000-0x00007FF6CFCE4000-memory.dmp	xmrig
behavioral2/memory/1492-747-0x00007FF70CEA0000-0x00007FF70D1F4000-memory.dmp	xmrig
behavioral2/memory/2944-742-0x00007FF6000E0000-0x00007FF600434000-memory.dmp	xmrig
behavioral2/memory/4452-740-0x00007FF776000000-0x00007FF776354000-memory.dmp	xmrig
behavioral2/memory/3568-736-0x00007FF6B55E0000-0x00007FF6B5934000-memory.dmp	xmrig
behavioral2/memory/4552-729-0x00007FF6EBB90000-0x00007FF6EBEE4000-memory.dmp	xmrig
behavioral2/memory/2136-759-0x00007FF71ECB0000-0x00007FF71F004000-memory.dmp	xmrig
behavioral2/memory/1428-722-0x00007FF6337F0000-0x00007FF633B44000-memory.dmp	xmrig
behavioral2/memory/3448-714-0x00007FF771ED0000-0x00007FF772224000-memory.dmp	xmrig
behavioral2/memory/4200-711-0x00007FF7E5D50000-0x00007FF7E60A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002344a-163.dat	xmrig
behavioral2/files/0x0007000000023449-156.dat	xmrig
behavioral2/files/0x0007000000023448-153.dat	xmrig
behavioral2/files/0x0007000000023446-144.dat	xmrig
behavioral2/files/0x0007000000023445-139.dat	xmrig
behavioral2/files/0x0007000000023444-134.dat	xmrig
behavioral2/memory/1132-770-0x00007FF7B3250000-0x00007FF7B35A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-129.dat	xmrig
behavioral2/files/0x0007000000023442-126.dat	xmrig
behavioral2/files/0x0007000000023441-121.dat	xmrig
behavioral2/files/0x000700000002343f-111.dat	xmrig
behavioral2/files/0x000700000002343d-101.dat	xmrig
behavioral2/files/0x000700000002343c-93.dat	xmrig
behavioral2/files/0x000700000002343b-89.dat	xmrig
behavioral2/files/0x000700000002343a-81.dat	xmrig
behavioral2/memory/3084-786-0x00007FF746D20000-0x00007FF747074000-memory.dmp	xmrig
behavioral2/memory/4868-783-0x00007FF6D2B10000-0x00007FF6D2E64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023439-78.dat	xmrig
behavioral2/files/0x0007000000023438-74.dat	xmrig
behavioral2/files/0x0007000000023437-69.dat	xmrig
behavioral2/files/0x0007000000023434-53.dat	xmrig
behavioral2/files/0x0007000000023432-41.dat	xmrig
behavioral2/files/0x0007000000023430-31.dat	xmrig
behavioral2/files/0x000700000002342e-22.dat	xmrig
behavioral2/memory/3120-802-0x00007FF66B3B0000-0x00007FF66B704000-memory.dmp	xmrig
behavioral2/memory/3724-795-0x00007FF727410000-0x00007FF727764000-memory.dmp	xmrig
behavioral2/memory/1716-791-0x00007FF698870000-0x00007FF698BC4000-memory.dmp	xmrig
behavioral2/memory/2476-2134-0x00007FF7E2A40000-0x00007FF7E2D94000-memory.dmp	xmrig
behavioral2/memory/3120-2135-0x00007FF66B3B0000-0x00007FF66B704000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2476	cMBzwbg.exe
3120	PdNQetN.exe
4436	ehfrjsx.exe
2984	LnCsyzj.exe
3788	HwoRevs.exe
4092	bMmeNfI.exe
2084	MmqGORI.exe
1360	KlNJDih.exe
4508	HKNOMxB.exe
744	jJUBWwn.exe
3228	BZJmABT.exe
2876	rbyGJVO.exe
4584	RIKJWUi.exe
2012	cdupsgL.exe
4200	zRHlbFU.exe
3448	QWAPKFL.exe
1428	XNfwDFN.exe
4552	ozxplAR.exe
3568	lunSgst.exe
4452	rGVPwjZ.exe
2944	EJQqcsr.exe
1492	XYJbpeP.exe
4568	fwlTgCu.exe
2136	CqrmGQJ.exe
1132	OzZfnpg.exe
4868	UbAglqf.exe
3084	BxIpgsv.exe
1716	VncHOkf.exe
3724	XCNdMfd.exe
2416	GJbzkYz.exe
2872	GpTGpkm.exe
1192	oyloINq.exe
1116	zfoWAQN.exe
2508	oBrgmJQ.exe
2496	dXcKjxT.exe
3684	rebMqXp.exe
3040	FoAZuKa.exe
3092	DQnoOhL.exe
1228	NxhIMQE.exe
2304	KilgAHc.exe
2460	lHTdDnG.exe
2776	HJwgaUr.exe
1508	sNYHMUu.exe
1308	eTJignV.exe
4524	oOXbdBX.exe
4464	vZJoCvd.exe
3744	NNSpyqx.exe
896	YGvWtMb.exe
4480	cxCpxiE.exe
2452	ryfExix.exe
4772	DRKcqpa.exe
3904	JrWeOIU.exe
3488	nlAilHa.exe
3296	FxxvvUf.exe
3632	WPkxEnr.exe
2212	HmjgQzG.exe
3220	ZmJAaLw.exe
3112	bfkyQoQ.exe
3908	YOyRMqr.exe
4396	kZceSDZ.exe
2256	XgfGsSU.exe
3948	qhOIIuG.exe
3152	KzKgSpf.exe
3388	ynAnvQg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/660-0-0x00007FF743E70000-0x00007FF7441C4000-memory.dmp	upx
behavioral2/files/0x000900000002341d-5.dat	upx
behavioral2/files/0x000700000002342c-9.dat	upx
behavioral2/files/0x000700000002342d-19.dat	upx
behavioral2/files/0x000700000002342f-25.dat	upx
behavioral2/files/0x0007000000023431-35.dat	upx
behavioral2/files/0x0007000000023433-46.dat	upx
behavioral2/files/0x0007000000023435-55.dat	upx
behavioral2/files/0x0007000000023436-63.dat	upx
behavioral2/files/0x000700000002343e-98.dat	upx
behavioral2/files/0x0007000000023440-116.dat	upx
behavioral2/files/0x0007000000023447-149.dat	upx
behavioral2/memory/2476-678-0x00007FF7E2A40000-0x00007FF7E2D94000-memory.dmp	upx
behavioral2/memory/4436-679-0x00007FF65E060000-0x00007FF65E3B4000-memory.dmp	upx
behavioral2/memory/2984-680-0x00007FF6718A0000-0x00007FF671BF4000-memory.dmp	upx
behavioral2/memory/3788-681-0x00007FF78B780000-0x00007FF78BAD4000-memory.dmp	upx
behavioral2/memory/4092-682-0x00007FF7F9EE0000-0x00007FF7FA234000-memory.dmp	upx
behavioral2/memory/1360-684-0x00007FF630250000-0x00007FF6305A4000-memory.dmp	upx
behavioral2/memory/4508-685-0x00007FF63BE80000-0x00007FF63C1D4000-memory.dmp	upx
behavioral2/memory/744-686-0x00007FF79A690000-0x00007FF79A9E4000-memory.dmp	upx
behavioral2/memory/2084-683-0x00007FF681BF0000-0x00007FF681F44000-memory.dmp	upx
behavioral2/memory/3228-687-0x00007FF743610000-0x00007FF743964000-memory.dmp	upx
behavioral2/memory/2876-688-0x00007FF746900000-0x00007FF746C54000-memory.dmp	upx
behavioral2/memory/4584-698-0x00007FF63B3C0000-0x00007FF63B714000-memory.dmp	upx
behavioral2/memory/2012-704-0x00007FF71B7E0000-0x00007FF71BB34000-memory.dmp	upx
behavioral2/memory/4568-753-0x00007FF6CF990000-0x00007FF6CFCE4000-memory.dmp	upx
behavioral2/memory/1492-747-0x00007FF70CEA0000-0x00007FF70D1F4000-memory.dmp	upx
behavioral2/memory/2944-742-0x00007FF6000E0000-0x00007FF600434000-memory.dmp	upx
behavioral2/memory/4452-740-0x00007FF776000000-0x00007FF776354000-memory.dmp	upx
behavioral2/memory/3568-736-0x00007FF6B55E0000-0x00007FF6B5934000-memory.dmp	upx
behavioral2/memory/4552-729-0x00007FF6EBB90000-0x00007FF6EBEE4000-memory.dmp	upx
behavioral2/memory/2136-759-0x00007FF71ECB0000-0x00007FF71F004000-memory.dmp	upx
behavioral2/memory/1428-722-0x00007FF6337F0000-0x00007FF633B44000-memory.dmp	upx
behavioral2/memory/3448-714-0x00007FF771ED0000-0x00007FF772224000-memory.dmp	upx
behavioral2/memory/4200-711-0x00007FF7E5D50000-0x00007FF7E60A4000-memory.dmp	upx
behavioral2/files/0x000700000002344a-163.dat	upx
behavioral2/files/0x0007000000023449-156.dat	upx
behavioral2/files/0x0007000000023448-153.dat	upx
behavioral2/files/0x0007000000023446-144.dat	upx
behavioral2/files/0x0007000000023445-139.dat	upx
behavioral2/files/0x0007000000023444-134.dat	upx
behavioral2/memory/1132-770-0x00007FF7B3250000-0x00007FF7B35A4000-memory.dmp	upx
behavioral2/files/0x0007000000023443-129.dat	upx
behavioral2/files/0x0007000000023442-126.dat	upx
behavioral2/files/0x0007000000023441-121.dat	upx
behavioral2/files/0x000700000002343f-111.dat	upx
behavioral2/files/0x000700000002343d-101.dat	upx
behavioral2/files/0x000700000002343c-93.dat	upx
behavioral2/files/0x000700000002343b-89.dat	upx
behavioral2/files/0x000700000002343a-81.dat	upx
behavioral2/memory/3084-786-0x00007FF746D20000-0x00007FF747074000-memory.dmp	upx
behavioral2/memory/4868-783-0x00007FF6D2B10000-0x00007FF6D2E64000-memory.dmp	upx
behavioral2/files/0x0007000000023439-78.dat	upx
behavioral2/files/0x0007000000023438-74.dat	upx
behavioral2/files/0x0007000000023437-69.dat	upx
behavioral2/files/0x0007000000023434-53.dat	upx
behavioral2/files/0x0007000000023432-41.dat	upx
behavioral2/files/0x0007000000023430-31.dat	upx
behavioral2/files/0x000700000002342e-22.dat	upx
behavioral2/memory/3120-802-0x00007FF66B3B0000-0x00007FF66B704000-memory.dmp	upx
behavioral2/memory/3724-795-0x00007FF727410000-0x00007FF727764000-memory.dmp	upx
behavioral2/memory/1716-791-0x00007FF698870000-0x00007FF698BC4000-memory.dmp	upx
behavioral2/memory/2476-2134-0x00007FF7E2A40000-0x00007FF7E2D94000-memory.dmp	upx
behavioral2/memory/3120-2135-0x00007FF66B3B0000-0x00007FF66B704000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eTJignV.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\HTNVXEv.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\BsAUeMa.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\QLpjbTb.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\eJIhAuQ.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\ikjOyxW.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\BtuDvZK.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\NxEKLBY.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\QRGRcYx.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\YjgatkO.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\DQnoOhL.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\CqDVhVd.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\GxnwWsT.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\TEBSsAk.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\NLJGWUj.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\nyZhTer.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\NPUtzPe.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\KpaQTCu.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\OmvwDmq.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\xHBZvum.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\CTRVXzQ.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\AFwtPrB.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\LKnuGEi.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\Enhxhkd.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\PTOndcc.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\KlNJDih.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\LeArUoI.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\SpKhfht.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\OltSMOG.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\DKsOFTM.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\mndBErO.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\qiyMyMd.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\inuLfoe.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\ZPUeYzk.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\LCljMBd.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\oyloINq.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\mjDNNOF.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\wtOUxpm.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\CwVebAU.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\GhFnjGi.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\dbPTjrt.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\ozxplAR.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\ZVlfEgW.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\FlUgVhj.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\FrqWRoW.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\UevFxkp.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\OxQqfST.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\hhNQnBo.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\iQJKjdB.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\xoVqrQZ.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\qkqEHEY.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\qhOIIuG.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\KQYIQTj.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\rmZPWPp.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\dIuJSWc.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\IYcsTbv.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\MCksUvv.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\kxMPyzu.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\tUijDCS.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\ZVXcpcK.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\PQqrbIv.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\HwoRevs.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\tKZryVJ.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
File created	C:\Windows\System\fOheQYk.exe	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2476	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	84
PID 660 wrote to memory of 2476	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	84
PID 660 wrote to memory of 3120	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	85
PID 660 wrote to memory of 3120	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	85
PID 660 wrote to memory of 4436	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	86
PID 660 wrote to memory of 4436	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	86
PID 660 wrote to memory of 2984	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	87
PID 660 wrote to memory of 2984	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	87
PID 660 wrote to memory of 3788	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	88
PID 660 wrote to memory of 3788	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	88
PID 660 wrote to memory of 4092	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	89
PID 660 wrote to memory of 4092	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	89
PID 660 wrote to memory of 2084	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	90
PID 660 wrote to memory of 2084	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	90
PID 660 wrote to memory of 1360	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	91
PID 660 wrote to memory of 1360	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	91
PID 660 wrote to memory of 4508	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	92
PID 660 wrote to memory of 4508	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	92
PID 660 wrote to memory of 744	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	93
PID 660 wrote to memory of 744	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	93
PID 660 wrote to memory of 3228	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	94
PID 660 wrote to memory of 3228	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	94
PID 660 wrote to memory of 2876	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	95
PID 660 wrote to memory of 2876	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	95
PID 660 wrote to memory of 4584	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	96
PID 660 wrote to memory of 4584	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	96
PID 660 wrote to memory of 2012	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	97
PID 660 wrote to memory of 2012	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	97
PID 660 wrote to memory of 4200	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	98
PID 660 wrote to memory of 4200	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	98
PID 660 wrote to memory of 3448	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	99
PID 660 wrote to memory of 3448	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	99
PID 660 wrote to memory of 1428	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	100
PID 660 wrote to memory of 1428	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	100
PID 660 wrote to memory of 4552	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	101
PID 660 wrote to memory of 4552	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	101
PID 660 wrote to memory of 3568	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	102
PID 660 wrote to memory of 3568	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	102
PID 660 wrote to memory of 4452	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	103
PID 660 wrote to memory of 4452	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	103
PID 660 wrote to memory of 2944	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	104
PID 660 wrote to memory of 2944	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	104
PID 660 wrote to memory of 1492	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	105
PID 660 wrote to memory of 1492	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	105
PID 660 wrote to memory of 4568	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	106
PID 660 wrote to memory of 4568	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	106
PID 660 wrote to memory of 2136	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	107
PID 660 wrote to memory of 2136	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	107
PID 660 wrote to memory of 1132	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	108
PID 660 wrote to memory of 1132	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	108
PID 660 wrote to memory of 4868	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	109
PID 660 wrote to memory of 4868	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	109
PID 660 wrote to memory of 3084	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	110
PID 660 wrote to memory of 3084	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	110
PID 660 wrote to memory of 1716	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	111
PID 660 wrote to memory of 1716	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	111
PID 660 wrote to memory of 3724	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	112
PID 660 wrote to memory of 3724	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	112
PID 660 wrote to memory of 2416	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	113
PID 660 wrote to memory of 2416	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	113
PID 660 wrote to memory of 2872	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	114
PID 660 wrote to memory of 2872	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	114
PID 660 wrote to memory of 1192	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	115
PID 660 wrote to memory of 1192	660	86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\86f17bb7e44f593c81fa13aa6b985fc0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\System\cMBzwbg.exe
  C:\Windows\System\cMBzwbg.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\PdNQetN.exe
  C:\Windows\System\PdNQetN.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\ehfrjsx.exe
  C:\Windows\System\ehfrjsx.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\LnCsyzj.exe
  C:\Windows\System\LnCsyzj.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\HwoRevs.exe
  C:\Windows\System\HwoRevs.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\bMmeNfI.exe
  C:\Windows\System\bMmeNfI.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\MmqGORI.exe
  C:\Windows\System\MmqGORI.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\KlNJDih.exe
  C:\Windows\System\KlNJDih.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\HKNOMxB.exe
  C:\Windows\System\HKNOMxB.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\jJUBWwn.exe
  C:\Windows\System\jJUBWwn.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\BZJmABT.exe
  C:\Windows\System\BZJmABT.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\rbyGJVO.exe
  C:\Windows\System\rbyGJVO.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\RIKJWUi.exe
  C:\Windows\System\RIKJWUi.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\cdupsgL.exe
  C:\Windows\System\cdupsgL.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\zRHlbFU.exe
  C:\Windows\System\zRHlbFU.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\QWAPKFL.exe
  C:\Windows\System\QWAPKFL.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\XNfwDFN.exe
  C:\Windows\System\XNfwDFN.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\ozxplAR.exe
  C:\Windows\System\ozxplAR.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\lunSgst.exe
  C:\Windows\System\lunSgst.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\rGVPwjZ.exe
  C:\Windows\System\rGVPwjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\EJQqcsr.exe
  C:\Windows\System\EJQqcsr.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\XYJbpeP.exe
  C:\Windows\System\XYJbpeP.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\fwlTgCu.exe
  C:\Windows\System\fwlTgCu.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\CqrmGQJ.exe
  C:\Windows\System\CqrmGQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\OzZfnpg.exe
  C:\Windows\System\OzZfnpg.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\UbAglqf.exe
  C:\Windows\System\UbAglqf.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\BxIpgsv.exe
  C:\Windows\System\BxIpgsv.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\VncHOkf.exe
  C:\Windows\System\VncHOkf.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\XCNdMfd.exe
  C:\Windows\System\XCNdMfd.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\GJbzkYz.exe
  C:\Windows\System\GJbzkYz.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\GpTGpkm.exe
  C:\Windows\System\GpTGpkm.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\oyloINq.exe
  C:\Windows\System\oyloINq.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\zfoWAQN.exe
  C:\Windows\System\zfoWAQN.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\oBrgmJQ.exe
  C:\Windows\System\oBrgmJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\dXcKjxT.exe
  C:\Windows\System\dXcKjxT.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\rebMqXp.exe
  C:\Windows\System\rebMqXp.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\FoAZuKa.exe
  C:\Windows\System\FoAZuKa.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\DQnoOhL.exe
  C:\Windows\System\DQnoOhL.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\NxhIMQE.exe
  C:\Windows\System\NxhIMQE.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\KilgAHc.exe
  C:\Windows\System\KilgAHc.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\lHTdDnG.exe
  C:\Windows\System\lHTdDnG.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\HJwgaUr.exe
  C:\Windows\System\HJwgaUr.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\sNYHMUu.exe
  C:\Windows\System\sNYHMUu.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\eTJignV.exe
  C:\Windows\System\eTJignV.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\oOXbdBX.exe
  C:\Windows\System\oOXbdBX.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\vZJoCvd.exe
  C:\Windows\System\vZJoCvd.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\NNSpyqx.exe
  C:\Windows\System\NNSpyqx.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\YGvWtMb.exe
  C:\Windows\System\YGvWtMb.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\cxCpxiE.exe
  C:\Windows\System\cxCpxiE.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\ryfExix.exe
  C:\Windows\System\ryfExix.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\DRKcqpa.exe
  C:\Windows\System\DRKcqpa.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\JrWeOIU.exe
  C:\Windows\System\JrWeOIU.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\nlAilHa.exe
  C:\Windows\System\nlAilHa.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\FxxvvUf.exe
  C:\Windows\System\FxxvvUf.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\WPkxEnr.exe
  C:\Windows\System\WPkxEnr.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\HmjgQzG.exe
  C:\Windows\System\HmjgQzG.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ZmJAaLw.exe
  C:\Windows\System\ZmJAaLw.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\bfkyQoQ.exe
  C:\Windows\System\bfkyQoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\YOyRMqr.exe
  C:\Windows\System\YOyRMqr.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\kZceSDZ.exe
  C:\Windows\System\kZceSDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\XgfGsSU.exe
  C:\Windows\System\XgfGsSU.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\qhOIIuG.exe
  C:\Windows\System\qhOIIuG.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\KzKgSpf.exe
  C:\Windows\System\KzKgSpf.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\ynAnvQg.exe
  C:\Windows\System\ynAnvQg.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\TJnqwud.exe
  C:\Windows\System\TJnqwud.exe
  2⤵
  PID:3000
- C:\Windows\System\tlWPwzX.exe
  C:\Windows\System\tlWPwzX.exe
  2⤵
  PID:3188
- C:\Windows\System\pKMWdYS.exe
  C:\Windows\System\pKMWdYS.exe
  2⤵
  PID:4920
- C:\Windows\System\zVPhmgU.exe
  C:\Windows\System\zVPhmgU.exe
  2⤵
  PID:2856
- C:\Windows\System\BzaeDks.exe
  C:\Windows\System\BzaeDks.exe
  2⤵
  PID:4832
- C:\Windows\System\osLjint.exe
  C:\Windows\System\osLjint.exe
  2⤵
  PID:788
- C:\Windows\System\mjDNNOF.exe
  C:\Windows\System\mjDNNOF.exe
  2⤵
  PID:2164
- C:\Windows\System\kNQUOvW.exe
  C:\Windows\System\kNQUOvW.exe
  2⤵
  PID:2852
- C:\Windows\System\eONDfXu.exe
  C:\Windows\System\eONDfXu.exe
  2⤵
  PID:3192
- C:\Windows\System\vuIPNeC.exe
  C:\Windows\System\vuIPNeC.exe
  2⤵
  PID:2352
- C:\Windows\System\yphcOrt.exe
  C:\Windows\System\yphcOrt.exe
  2⤵
  PID:3052
- C:\Windows\System\tKZryVJ.exe
  C:\Windows\System\tKZryVJ.exe
  2⤵
  PID:3720
- C:\Windows\System\zoGArul.exe
  C:\Windows\System\zoGArul.exe
  2⤵
  PID:1352
- C:\Windows\System\rPITxIT.exe
  C:\Windows\System\rPITxIT.exe
  2⤵
  PID:2064
- C:\Windows\System\uXYcKZK.exe
  C:\Windows\System\uXYcKZK.exe
  2⤵
  PID:5144
- C:\Windows\System\VIFgbVZ.exe
  C:\Windows\System\VIFgbVZ.exe
  2⤵
  PID:5172
- C:\Windows\System\VSypICG.exe
  C:\Windows\System\VSypICG.exe
  2⤵
  PID:5200
- C:\Windows\System\bcVPOUV.exe
  C:\Windows\System\bcVPOUV.exe
  2⤵
  PID:5228
- C:\Windows\System\LPFNLNS.exe
  C:\Windows\System\LPFNLNS.exe
  2⤵
  PID:5256
- C:\Windows\System\HTNVXEv.exe
  C:\Windows\System\HTNVXEv.exe
  2⤵
  PID:5288
- C:\Windows\System\mQcdIHv.exe
  C:\Windows\System\mQcdIHv.exe
  2⤵
  PID:5320
- C:\Windows\System\awPeObf.exe
  C:\Windows\System\awPeObf.exe
  2⤵
  PID:5340
- C:\Windows\System\MXrJglY.exe
  C:\Windows\System\MXrJglY.exe
  2⤵
  PID:5368
- C:\Windows\System\FfuQEnH.exe
  C:\Windows\System\FfuQEnH.exe
  2⤵
  PID:5392
- C:\Windows\System\wxATMRY.exe
  C:\Windows\System\wxATMRY.exe
  2⤵
  PID:5420
- C:\Windows\System\iTcdsHV.exe
  C:\Windows\System\iTcdsHV.exe
  2⤵
  PID:5452
- C:\Windows\System\bYMHfVs.exe
  C:\Windows\System\bYMHfVs.exe
  2⤵
  PID:5480
- C:\Windows\System\iYZXyTG.exe
  C:\Windows\System\iYZXyTG.exe
  2⤵
  PID:5508
- C:\Windows\System\ugMvtDq.exe
  C:\Windows\System\ugMvtDq.exe
  2⤵
  PID:5536
- C:\Windows\System\jFrBcni.exe
  C:\Windows\System\jFrBcni.exe
  2⤵
  PID:5564
- C:\Windows\System\DNxzRSv.exe
  C:\Windows\System\DNxzRSv.exe
  2⤵
  PID:5592
- C:\Windows\System\CYnvsPJ.exe
  C:\Windows\System\CYnvsPJ.exe
  2⤵
  PID:5620
- C:\Windows\System\pIWzptr.exe
  C:\Windows\System\pIWzptr.exe
  2⤵
  PID:5648
- C:\Windows\System\WiLEcBH.exe
  C:\Windows\System\WiLEcBH.exe
  2⤵
  PID:5676
- C:\Windows\System\wtOUxpm.exe
  C:\Windows\System\wtOUxpm.exe
  2⤵
  PID:5704
- C:\Windows\System\lwjACNB.exe
  C:\Windows\System\lwjACNB.exe
  2⤵
  PID:5732
- C:\Windows\System\EpYMqry.exe
  C:\Windows\System\EpYMqry.exe
  2⤵
  PID:5760
- C:\Windows\System\aTXseaw.exe
  C:\Windows\System\aTXseaw.exe
  2⤵
  PID:5788
- C:\Windows\System\QsrkcMH.exe
  C:\Windows\System\QsrkcMH.exe
  2⤵
  PID:5812
- C:\Windows\System\rHwTYfS.exe
  C:\Windows\System\rHwTYfS.exe
  2⤵
  PID:5844
- C:\Windows\System\wiQnAcM.exe
  C:\Windows\System\wiQnAcM.exe
  2⤵
  PID:5868
- C:\Windows\System\UZCMjqe.exe
  C:\Windows\System\UZCMjqe.exe
  2⤵
  PID:5900
- C:\Windows\System\bIeXyKb.exe
  C:\Windows\System\bIeXyKb.exe
  2⤵
  PID:5928
- C:\Windows\System\MgtMQOf.exe
  C:\Windows\System\MgtMQOf.exe
  2⤵
  PID:5956
- C:\Windows\System\qHHjndQ.exe
  C:\Windows\System\qHHjndQ.exe
  2⤵
  PID:5984
- C:\Windows\System\qdQHeSP.exe
  C:\Windows\System\qdQHeSP.exe
  2⤵
  PID:6012
- C:\Windows\System\qEHDFIH.exe
  C:\Windows\System\qEHDFIH.exe
  2⤵
  PID:6040
- C:\Windows\System\LXJsNVV.exe
  C:\Windows\System\LXJsNVV.exe
  2⤵
  PID:6068
- C:\Windows\System\QPsEatk.exe
  C:\Windows\System\QPsEatk.exe
  2⤵
  PID:6096
- C:\Windows\System\BNXyKBq.exe
  C:\Windows\System\BNXyKBq.exe
  2⤵
  PID:6124
- C:\Windows\System\ILpfhEJ.exe
  C:\Windows\System\ILpfhEJ.exe
  2⤵
  PID:3348
- C:\Windows\System\QxSDxCu.exe
  C:\Windows\System\QxSDxCu.exe
  2⤵
  PID:2328
- C:\Windows\System\tUijDCS.exe
  C:\Windows\System\tUijDCS.exe
  2⤵
  PID:1208
- C:\Windows\System\vmrhIaH.exe
  C:\Windows\System\vmrhIaH.exe
  2⤵
  PID:1164
- C:\Windows\System\opAQCqX.exe
  C:\Windows\System\opAQCqX.exe
  2⤵
  PID:1980
- C:\Windows\System\SpKhfht.exe
  C:\Windows\System\SpKhfht.exe
  2⤵
  PID:5128
- C:\Windows\System\TbQBseq.exe
  C:\Windows\System\TbQBseq.exe
  2⤵
  PID:5188
- C:\Windows\System\zaSlyBR.exe
  C:\Windows\System\zaSlyBR.exe
  2⤵
  PID:5248
- C:\Windows\System\QEQcpnK.exe
  C:\Windows\System\QEQcpnK.exe
  2⤵
  PID:5316
- C:\Windows\System\mEmaDFC.exe
  C:\Windows\System\mEmaDFC.exe
  2⤵
  PID:5384
- C:\Windows\System\qjxIWoe.exe
  C:\Windows\System\qjxIWoe.exe
  2⤵
  PID:5444
- C:\Windows\System\lcjGmUX.exe
  C:\Windows\System\lcjGmUX.exe
  2⤵
  PID:5520
- C:\Windows\System\ZProVZJ.exe
  C:\Windows\System\ZProVZJ.exe
  2⤵
  PID:5580
- C:\Windows\System\gYEAlGi.exe
  C:\Windows\System\gYEAlGi.exe
  2⤵
  PID:5640
- C:\Windows\System\gKAWRZW.exe
  C:\Windows\System\gKAWRZW.exe
  2⤵
  PID:5716
- C:\Windows\System\ODLKCVM.exe
  C:\Windows\System\ODLKCVM.exe
  2⤵
  PID:5776
- C:\Windows\System\reyTcCC.exe
  C:\Windows\System\reyTcCC.exe
  2⤵
  PID:5836
- C:\Windows\System\oPfsCTB.exe
  C:\Windows\System\oPfsCTB.exe
  2⤵
  PID:5912
- C:\Windows\System\BHIHeGv.exe
  C:\Windows\System\BHIHeGv.exe
  2⤵
  PID:5972
- C:\Windows\System\ikjOyxW.exe
  C:\Windows\System\ikjOyxW.exe
  2⤵
  PID:6028
- C:\Windows\System\tAeCreO.exe
  C:\Windows\System\tAeCreO.exe
  2⤵
  PID:6088
- C:\Windows\System\hsASqhl.exe
  C:\Windows\System\hsASqhl.exe
  2⤵
  PID:1924
- C:\Windows\System\NiktOfW.exe
  C:\Windows\System\NiktOfW.exe
  2⤵
  PID:4028
- C:\Windows\System\GSAwxkL.exe
  C:\Windows\System\GSAwxkL.exe
  2⤵
  PID:1932
- C:\Windows\System\KblCmiN.exe
  C:\Windows\System\KblCmiN.exe
  2⤵
  PID:5284
- C:\Windows\System\kxDVTzR.exe
  C:\Windows\System\kxDVTzR.exe
  2⤵
  PID:5416
- C:\Windows\System\AvqHGVf.exe
  C:\Windows\System\AvqHGVf.exe
  2⤵
  PID:5556
- C:\Windows\System\bRBaePC.exe
  C:\Windows\System\bRBaePC.exe
  2⤵
  PID:5744
- C:\Windows\System\CqDVhVd.exe
  C:\Windows\System\CqDVhVd.exe
  2⤵
  PID:5884
- C:\Windows\System\GLRIOaS.exe
  C:\Windows\System\GLRIOaS.exe
  2⤵
  PID:6152
- C:\Windows\System\zpLLxKy.exe
  C:\Windows\System\zpLLxKy.exe
  2⤵
  PID:6176
- C:\Windows\System\JQBxfQf.exe
  C:\Windows\System\JQBxfQf.exe
  2⤵
  PID:6208
- C:\Windows\System\YGssEfe.exe
  C:\Windows\System\YGssEfe.exe
  2⤵
  PID:6240
- C:\Windows\System\YJrElLR.exe
  C:\Windows\System\YJrElLR.exe
  2⤵
  PID:6264
- C:\Windows\System\SlgsxeO.exe
  C:\Windows\System\SlgsxeO.exe
  2⤵
  PID:6292
- C:\Windows\System\qVnDnzD.exe
  C:\Windows\System\qVnDnzD.exe
  2⤵
  PID:6320
- C:\Windows\System\SrAxYwt.exe
  C:\Windows\System\SrAxYwt.exe
  2⤵
  PID:6348
- C:\Windows\System\eMcRbDD.exe
  C:\Windows\System\eMcRbDD.exe
  2⤵
  PID:6376
- C:\Windows\System\ewsgsTB.exe
  C:\Windows\System\ewsgsTB.exe
  2⤵
  PID:6404
- C:\Windows\System\fOheQYk.exe
  C:\Windows\System\fOheQYk.exe
  2⤵
  PID:6432
- C:\Windows\System\JBoxfTm.exe
  C:\Windows\System\JBoxfTm.exe
  2⤵
  PID:6460
- C:\Windows\System\ZVXcpcK.exe
  C:\Windows\System\ZVXcpcK.exe
  2⤵
  PID:6488
- C:\Windows\System\ABztbAI.exe
  C:\Windows\System\ABztbAI.exe
  2⤵
  PID:6516
- C:\Windows\System\ahhcqwd.exe
  C:\Windows\System\ahhcqwd.exe
  2⤵
  PID:6544
- C:\Windows\System\BlZqBQB.exe
  C:\Windows\System\BlZqBQB.exe
  2⤵
  PID:6572
- C:\Windows\System\yYyNNxa.exe
  C:\Windows\System\yYyNNxa.exe
  2⤵
  PID:6600
- C:\Windows\System\IJSGgVI.exe
  C:\Windows\System\IJSGgVI.exe
  2⤵
  PID:6628
- C:\Windows\System\uJUSfmB.exe
  C:\Windows\System\uJUSfmB.exe
  2⤵
  PID:6656
- C:\Windows\System\KeHVZBD.exe
  C:\Windows\System\KeHVZBD.exe
  2⤵
  PID:6684
- C:\Windows\System\gbyBFSG.exe
  C:\Windows\System\gbyBFSG.exe
  2⤵
  PID:6712
- C:\Windows\System\OxQqfST.exe
  C:\Windows\System\OxQqfST.exe
  2⤵
  PID:6740
- C:\Windows\System\jQidxlx.exe
  C:\Windows\System\jQidxlx.exe
  2⤵
  PID:6768
- C:\Windows\System\DssdYPf.exe
  C:\Windows\System\DssdYPf.exe
  2⤵
  PID:6796
- C:\Windows\System\IXMFoOi.exe
  C:\Windows\System\IXMFoOi.exe
  2⤵
  PID:6824
- C:\Windows\System\wwgqYLX.exe
  C:\Windows\System\wwgqYLX.exe
  2⤵
  PID:6852
- C:\Windows\System\JsUHBAe.exe
  C:\Windows\System\JsUHBAe.exe
  2⤵
  PID:6880
- C:\Windows\System\gyxCoqq.exe
  C:\Windows\System\gyxCoqq.exe
  2⤵
  PID:6908
- C:\Windows\System\weLTeEk.exe
  C:\Windows\System\weLTeEk.exe
  2⤵
  PID:6936
- C:\Windows\System\roTGfuy.exe
  C:\Windows\System\roTGfuy.exe
  2⤵
  PID:6964
- C:\Windows\System\WquXMBI.exe
  C:\Windows\System\WquXMBI.exe
  2⤵
  PID:6992
- C:\Windows\System\NfRLnoa.exe
  C:\Windows\System\NfRLnoa.exe
  2⤵
  PID:7020
- C:\Windows\System\aucyDOp.exe
  C:\Windows\System\aucyDOp.exe
  2⤵
  PID:7048
- C:\Windows\System\alQmyOF.exe
  C:\Windows\System\alQmyOF.exe
  2⤵
  PID:7076
- C:\Windows\System\yyyIdfq.exe
  C:\Windows\System\yyyIdfq.exe
  2⤵
  PID:7104
- C:\Windows\System\RQbRaUx.exe
  C:\Windows\System\RQbRaUx.exe
  2⤵
  PID:7132
- C:\Windows\System\YbPZGGo.exe
  C:\Windows\System\YbPZGGo.exe
  2⤵
  PID:7160
- C:\Windows\System\XkMTvNY.exe
  C:\Windows\System\XkMTvNY.exe
  2⤵
  PID:6116
- C:\Windows\System\dfmZEjX.exe
  C:\Windows\System\dfmZEjX.exe
  2⤵
  PID:4164
- C:\Windows\System\mndBErO.exe
  C:\Windows\System\mndBErO.exe
  2⤵
  PID:5356
- C:\Windows\System\jTRiSrm.exe
  C:\Windows\System\jTRiSrm.exe
  2⤵
  PID:5688
- C:\Windows\System\usanWYp.exe
  C:\Windows\System\usanWYp.exe
  2⤵
  PID:6164
- C:\Windows\System\KQYIQTj.exe
  C:\Windows\System\KQYIQTj.exe
  2⤵
  PID:6224
- C:\Windows\System\jcbcMKf.exe
  C:\Windows\System\jcbcMKf.exe
  2⤵
  PID:6280
- C:\Windows\System\ioBZPFk.exe
  C:\Windows\System\ioBZPFk.exe
  2⤵
  PID:6340
- C:\Windows\System\nBUGADW.exe
  C:\Windows\System\nBUGADW.exe
  2⤵
  PID:6416
- C:\Windows\System\MaiiOcs.exe
  C:\Windows\System\MaiiOcs.exe
  2⤵
  PID:6476
- C:\Windows\System\mjCmwXW.exe
  C:\Windows\System\mjCmwXW.exe
  2⤵
  PID:6536
- C:\Windows\System\OUBUlwi.exe
  C:\Windows\System\OUBUlwi.exe
  2⤵
  PID:6592
- C:\Windows\System\tUrYIag.exe
  C:\Windows\System\tUrYIag.exe
  2⤵
  PID:6668
- C:\Windows\System\yUQpSAu.exe
  C:\Windows\System\yUQpSAu.exe
  2⤵
  PID:6724
- C:\Windows\System\FUPlUkY.exe
  C:\Windows\System\FUPlUkY.exe
  2⤵
  PID:6784
- C:\Windows\System\uXxcsNq.exe
  C:\Windows\System\uXxcsNq.exe
  2⤵
  PID:6844
- C:\Windows\System\FnGzGRj.exe
  C:\Windows\System\FnGzGRj.exe
  2⤵
  PID:6900
- C:\Windows\System\RUpKJuv.exe
  C:\Windows\System\RUpKJuv.exe
  2⤵
  PID:1080
- C:\Windows\System\JLDpEss.exe
  C:\Windows\System\JLDpEss.exe
  2⤵
  PID:7012
- C:\Windows\System\tRQgbbV.exe
  C:\Windows\System\tRQgbbV.exe
  2⤵
  PID:7068
- C:\Windows\System\pQZdnpj.exe
  C:\Windows\System\pQZdnpj.exe
  2⤵
  PID:7120
- C:\Windows\System\hsEpmnu.exe
  C:\Windows\System\hsEpmnu.exe
  2⤵
  PID:6060
- C:\Windows\System\BtuDvZK.exe
  C:\Windows\System\BtuDvZK.exe
  2⤵
  PID:5216
- C:\Windows\System\dxmpDtF.exe
  C:\Windows\System\dxmpDtF.exe
  2⤵
  PID:892
- C:\Windows\System\hVqmawa.exe
  C:\Windows\System\hVqmawa.exe
  2⤵
  PID:1616
- C:\Windows\System\IUMzyEx.exe
  C:\Windows\System\IUMzyEx.exe
  2⤵
  PID:6392
- C:\Windows\System\viEfGbD.exe
  C:\Windows\System\viEfGbD.exe
  2⤵
  PID:6980
- C:\Windows\System\qiyMyMd.exe
  C:\Windows\System\qiyMyMd.exe
  2⤵
  PID:7060
- C:\Windows\System\jQrftJr.exe
  C:\Windows\System\jQrftJr.exe
  2⤵
  PID:5096
- C:\Windows\System\muZLCBT.exe
  C:\Windows\System\muZLCBT.exe
  2⤵
  PID:5632
- C:\Windows\System\gMPOxRv.exe
  C:\Windows\System\gMPOxRv.exe
  2⤵
  PID:6196
- C:\Windows\System\vPsFupz.exe
  C:\Windows\System\vPsFupz.exe
  2⤵
  PID:5548
- C:\Windows\System\lxoaXqH.exe
  C:\Windows\System\lxoaXqH.exe
  2⤵
  PID:4892
- C:\Windows\System\bbGaSCr.exe
  C:\Windows\System\bbGaSCr.exe
  2⤵
  PID:1536
- C:\Windows\System\tYnXIFq.exe
  C:\Windows\System\tYnXIFq.exe
  2⤵
  PID:2968
- C:\Windows\System\vPrugLp.exe
  C:\Windows\System\vPrugLp.exe
  2⤵
  PID:4988
- C:\Windows\System\inuLfoe.exe
  C:\Windows\System\inuLfoe.exe
  2⤵
  PID:1420
- C:\Windows\System\bHJbCOy.exe
  C:\Windows\System\bHJbCOy.exe
  2⤵
  PID:2244
- C:\Windows\System\OltSMOG.exe
  C:\Windows\System\OltSMOG.exe
  2⤵
  PID:876
- C:\Windows\System\BsAUeMa.exe
  C:\Windows\System\BsAUeMa.exe
  2⤵
  PID:1692
- C:\Windows\System\BQKPylR.exe
  C:\Windows\System\BQKPylR.exe
  2⤵
  PID:6316
- C:\Windows\System\vyegUsx.exe
  C:\Windows\System\vyegUsx.exe
  2⤵
  PID:4348
- C:\Windows\System\kujLzDu.exe
  C:\Windows\System\kujLzDu.exe
  2⤵
  PID:552
- C:\Windows\System\xTcHXky.exe
  C:\Windows\System\xTcHXky.exe
  2⤵
  PID:6928
- C:\Windows\System\QDkPHjO.exe
  C:\Windows\System\QDkPHjO.exe
  2⤵
  PID:7192
- C:\Windows\System\CHNdvrs.exe
  C:\Windows\System\CHNdvrs.exe
  2⤵
  PID:7212
- C:\Windows\System\DWZPxZG.exe
  C:\Windows\System\DWZPxZG.exe
  2⤵
  PID:7232
- C:\Windows\System\RiXkvhv.exe
  C:\Windows\System\RiXkvhv.exe
  2⤵
  PID:7264
- C:\Windows\System\jUsguhH.exe
  C:\Windows\System\jUsguhH.exe
  2⤵
  PID:7352
- C:\Windows\System\cFvAwPq.exe
  C:\Windows\System\cFvAwPq.exe
  2⤵
  PID:7372
- C:\Windows\System\YteoLpm.exe
  C:\Windows\System\YteoLpm.exe
  2⤵
  PID:7400
- C:\Windows\System\oKojuvf.exe
  C:\Windows\System\oKojuvf.exe
  2⤵
  PID:7416
- C:\Windows\System\NgyarBm.exe
  C:\Windows\System\NgyarBm.exe
  2⤵
  PID:7440
- C:\Windows\System\leHeRbs.exe
  C:\Windows\System\leHeRbs.exe
  2⤵
  PID:7464
- C:\Windows\System\FHXhgFT.exe
  C:\Windows\System\FHXhgFT.exe
  2⤵
  PID:7496
- C:\Windows\System\pwffkJy.exe
  C:\Windows\System\pwffkJy.exe
  2⤵
  PID:7540
- C:\Windows\System\avrJzDy.exe
  C:\Windows\System\avrJzDy.exe
  2⤵
  PID:7568
- C:\Windows\System\cDOZmpV.exe
  C:\Windows\System\cDOZmpV.exe
  2⤵
  PID:7608
- C:\Windows\System\oHFwYcc.exe
  C:\Windows\System\oHFwYcc.exe
  2⤵
  PID:7628
- C:\Windows\System\DHysNAy.exe
  C:\Windows\System\DHysNAy.exe
  2⤵
  PID:7676
- C:\Windows\System\cJPhOul.exe
  C:\Windows\System\cJPhOul.exe
  2⤵
  PID:7692
- C:\Windows\System\baHlMbb.exe
  C:\Windows\System\baHlMbb.exe
  2⤵
  PID:7712
- C:\Windows\System\NLGjYJk.exe
  C:\Windows\System\NLGjYJk.exe
  2⤵
  PID:7804
- C:\Windows\System\dKiIDZu.exe
  C:\Windows\System\dKiIDZu.exe
  2⤵
  PID:7836
- C:\Windows\System\wwWzEZo.exe
  C:\Windows\System\wwWzEZo.exe
  2⤵
  PID:7864
- C:\Windows\System\VtnCLfr.exe
  C:\Windows\System\VtnCLfr.exe
  2⤵
  PID:7892
- C:\Windows\System\audkkAt.exe
  C:\Windows\System\audkkAt.exe
  2⤵
  PID:7916
- C:\Windows\System\HrovDNZ.exe
  C:\Windows\System\HrovDNZ.exe
  2⤵
  PID:7936
- C:\Windows\System\CxRrLlk.exe
  C:\Windows\System\CxRrLlk.exe
  2⤵
  PID:7988
- C:\Windows\System\DNybsJM.exe
  C:\Windows\System\DNybsJM.exe
  2⤵
  PID:8008
- C:\Windows\System\hYFOsJj.exe
  C:\Windows\System\hYFOsJj.exe
  2⤵
  PID:8052
- C:\Windows\System\SIntnMi.exe
  C:\Windows\System\SIntnMi.exe
  2⤵
  PID:8080
- C:\Windows\System\sBPIwmc.exe
  C:\Windows\System\sBPIwmc.exe
  2⤵
  PID:8100
- C:\Windows\System\FSnzpAO.exe
  C:\Windows\System\FSnzpAO.exe
  2⤵
  PID:8132
- C:\Windows\System\gxDdOss.exe
  C:\Windows\System\gxDdOss.exe
  2⤵
  PID:8172
- C:\Windows\System\rmZPWPp.exe
  C:\Windows\System\rmZPWPp.exe
  2⤵
  PID:3624
- C:\Windows\System\UrwLGFG.exe
  C:\Windows\System\UrwLGFG.exe
  2⤵
  PID:3476
- C:\Windows\System\iHtvWXT.exe
  C:\Windows\System\iHtvWXT.exe
  2⤵
  PID:7184
- C:\Windows\System\xVxmNrk.exe
  C:\Windows\System\xVxmNrk.exe
  2⤵
  PID:7256
- C:\Windows\System\xWRSKyD.exe
  C:\Windows\System\xWRSKyD.exe
  2⤵
  PID:6004
- C:\Windows\System\YJYXfkO.exe
  C:\Windows\System\YJYXfkO.exe
  2⤵
  PID:3380
- C:\Windows\System\hhNQnBo.exe
  C:\Windows\System\hhNQnBo.exe
  2⤵
  PID:7392
- C:\Windows\System\GqDZdJF.exe
  C:\Windows\System\GqDZdJF.exe
  2⤵
  PID:7388
- C:\Windows\System\YFUKNqI.exe
  C:\Windows\System\YFUKNqI.exe
  2⤵
  PID:7508
- C:\Windows\System\LdMqPes.exe
  C:\Windows\System\LdMqPes.exe
  2⤵
  PID:7548
- C:\Windows\System\WJsBMCz.exe
  C:\Windows\System\WJsBMCz.exe
  2⤵
  PID:1864
- C:\Windows\System\XNCAFSv.exe
  C:\Windows\System\XNCAFSv.exe
  2⤵
  PID:7700
- C:\Windows\System\SybyXsF.exe
  C:\Windows\System\SybyXsF.exe
  2⤵
  PID:500
- C:\Windows\System\QxGNXTo.exe
  C:\Windows\System\QxGNXTo.exe
  2⤵
  PID:7448
- C:\Windows\System\OvVWGAh.exe
  C:\Windows\System\OvVWGAh.exe
  2⤵
  PID:7800
- C:\Windows\System\BykvHHC.exe
  C:\Windows\System\BykvHHC.exe
  2⤵
  PID:7876
- C:\Windows\System\hOCPnqW.exe
  C:\Windows\System\hOCPnqW.exe
  2⤵
  PID:7912
- C:\Windows\System\oscNMCQ.exe
  C:\Windows\System\oscNMCQ.exe
  2⤵
  PID:7984
- C:\Windows\System\GExgOvl.exe
  C:\Windows\System\GExgOvl.exe
  2⤵
  PID:8072
- C:\Windows\System\LRaMjYn.exe
  C:\Windows\System\LRaMjYn.exe
  2⤵
  PID:8108
- C:\Windows\System\KquPypl.exe
  C:\Windows\System\KquPypl.exe
  2⤵
  PID:8164
- C:\Windows\System\kEEIXXy.exe
  C:\Windows\System\kEEIXXy.exe
  2⤵
  PID:7180
- C:\Windows\System\eNyCdHP.exe
  C:\Windows\System\eNyCdHP.exe
  2⤵
  PID:6256
- C:\Windows\System\KhQHqxT.exe
  C:\Windows\System\KhQHqxT.exe
  2⤵
  PID:7344
- C:\Windows\System\HMyTJpu.exe
  C:\Windows\System\HMyTJpu.exe
  2⤵
  PID:7648
- C:\Windows\System\TnLcZsr.exe
  C:\Windows\System\TnLcZsr.exe
  2⤵
  PID:7740
- C:\Windows\System\GuNzcAG.exe
  C:\Windows\System\GuNzcAG.exe
  2⤵
  PID:7348
- C:\Windows\System\iQJKjdB.exe
  C:\Windows\System\iQJKjdB.exe
  2⤵
  PID:7924
- C:\Windows\System\OmvwDmq.exe
  C:\Windows\System\OmvwDmq.exe
  2⤵
  PID:8096
- C:\Windows\System\hapImfA.exe
  C:\Windows\System\hapImfA.exe
  2⤵
  PID:6872
- C:\Windows\System\wYwatjU.exe
  C:\Windows\System\wYwatjU.exe
  2⤵
  PID:7412
- C:\Windows\System\EvDpsFQ.exe
  C:\Windows\System\EvDpsFQ.exe
  2⤵
  PID:8016
- C:\Windows\System\IFvYejb.exe
  C:\Windows\System\IFvYejb.exe
  2⤵
  PID:7240
- C:\Windows\System\BCIphwo.exe
  C:\Windows\System\BCIphwo.exe
  2⤵
  PID:4844
- C:\Windows\System\VMuHIRW.exe
  C:\Windows\System\VMuHIRW.exe
  2⤵
  PID:8204
- C:\Windows\System\HEjLruH.exe
  C:\Windows\System\HEjLruH.exe
  2⤵
  PID:8236
- C:\Windows\System\PzyBcMB.exe
  C:\Windows\System\PzyBcMB.exe
  2⤵
  PID:8264
- C:\Windows\System\LZNKdAI.exe
  C:\Windows\System\LZNKdAI.exe
  2⤵
  PID:8292
- C:\Windows\System\PqWhtIw.exe
  C:\Windows\System\PqWhtIw.exe
  2⤵
  PID:8324
- C:\Windows\System\tCnhhBN.exe
  C:\Windows\System\tCnhhBN.exe
  2⤵
  PID:8348
- C:\Windows\System\CbcFZEf.exe
  C:\Windows\System\CbcFZEf.exe
  2⤵
  PID:8380
- C:\Windows\System\jkyspxd.exe
  C:\Windows\System\jkyspxd.exe
  2⤵
  PID:8408
- C:\Windows\System\YOtUmnU.exe
  C:\Windows\System\YOtUmnU.exe
  2⤵
  PID:8440
- C:\Windows\System\cGCkoKW.exe
  C:\Windows\System\cGCkoKW.exe
  2⤵
  PID:8468
- C:\Windows\System\zbKtIMM.exe
  C:\Windows\System\zbKtIMM.exe
  2⤵
  PID:8492
- C:\Windows\System\ZsbfZBB.exe
  C:\Windows\System\ZsbfZBB.exe
  2⤵
  PID:8524
- C:\Windows\System\KVslCUP.exe
  C:\Windows\System\KVslCUP.exe
  2⤵
  PID:8552
- C:\Windows\System\pUInoiD.exe
  C:\Windows\System\pUInoiD.exe
  2⤵
  PID:8584
- C:\Windows\System\HfhZhmu.exe
  C:\Windows\System\HfhZhmu.exe
  2⤵
  PID:8612
- C:\Windows\System\glLxoly.exe
  C:\Windows\System\glLxoly.exe
  2⤵
  PID:8640
- C:\Windows\System\HcXSMPG.exe
  C:\Windows\System\HcXSMPG.exe
  2⤵
  PID:8668
- C:\Windows\System\AdlRXWE.exe
  C:\Windows\System\AdlRXWE.exe
  2⤵
  PID:8692
- C:\Windows\System\bZXybLM.exe
  C:\Windows\System\bZXybLM.exe
  2⤵
  PID:8712
- C:\Windows\System\UqtLhqC.exe
  C:\Windows\System\UqtLhqC.exe
  2⤵
  PID:8752
- C:\Windows\System\agbFNtg.exe
  C:\Windows\System\agbFNtg.exe
  2⤵
  PID:8776
- C:\Windows\System\TFzwcDJ.exe
  C:\Windows\System\TFzwcDJ.exe
  2⤵
  PID:8832
- C:\Windows\System\zGnwRtf.exe
  C:\Windows\System\zGnwRtf.exe
  2⤵
  PID:8848
- C:\Windows\System\IcLVuwX.exe
  C:\Windows\System\IcLVuwX.exe
  2⤵
  PID:8884
- C:\Windows\System\wwFpFkP.exe
  C:\Windows\System\wwFpFkP.exe
  2⤵
  PID:8908
- C:\Windows\System\reoVZYp.exe
  C:\Windows\System\reoVZYp.exe
  2⤵
  PID:8924
- C:\Windows\System\LKzedOw.exe
  C:\Windows\System\LKzedOw.exe
  2⤵
  PID:8952
- C:\Windows\System\chmVxKk.exe
  C:\Windows\System\chmVxKk.exe
  2⤵
  PID:8988
- C:\Windows\System\XuDCMuk.exe
  C:\Windows\System\XuDCMuk.exe
  2⤵
  PID:9012
- C:\Windows\System\PuyHzQq.exe
  C:\Windows\System\PuyHzQq.exe
  2⤵
  PID:9048
- C:\Windows\System\sHyuYzB.exe
  C:\Windows\System\sHyuYzB.exe
  2⤵
  PID:9076
- C:\Windows\System\gaTUXfI.exe
  C:\Windows\System\gaTUXfI.exe
  2⤵
  PID:9104
- C:\Windows\System\cGKRgYm.exe
  C:\Windows\System\cGKRgYm.exe
  2⤵
  PID:9132
- C:\Windows\System\lUDHbyO.exe
  C:\Windows\System\lUDHbyO.exe
  2⤵
  PID:9160
- C:\Windows\System\WDXWCys.exe
  C:\Windows\System\WDXWCys.exe
  2⤵
  PID:9184
- C:\Windows\System\WiWOVIC.exe
  C:\Windows\System\WiWOVIC.exe
  2⤵
  PID:9212
- C:\Windows\System\SvjXonB.exe
  C:\Windows\System\SvjXonB.exe
  2⤵
  PID:8276
- C:\Windows\System\JdJOEJP.exe
  C:\Windows\System\JdJOEJP.exe
  2⤵
  PID:8356
- C:\Windows\System\GwwLdqd.exe
  C:\Windows\System\GwwLdqd.exe
  2⤵
  PID:8400
- C:\Windows\System\qIddfyx.exe
  C:\Windows\System\qIddfyx.exe
  2⤵
  PID:8464
- C:\Windows\System\nhNJXmv.exe
  C:\Windows\System\nhNJXmv.exe
  2⤵
  PID:8544
- C:\Windows\System\sznkpCZ.exe
  C:\Windows\System\sznkpCZ.exe
  2⤵
  PID:8600
- C:\Windows\System\JvLhdzV.exe
  C:\Windows\System\JvLhdzV.exe
  2⤵
  PID:8660
- C:\Windows\System\rQOnJMH.exe
  C:\Windows\System\rQOnJMH.exe
  2⤵
  PID:8704
- C:\Windows\System\ZPUeYzk.exe
  C:\Windows\System\ZPUeYzk.exe
  2⤵
  PID:8788
- C:\Windows\System\MzGhfzJ.exe
  C:\Windows\System\MzGhfzJ.exe
  2⤵
  PID:8840
- C:\Windows\System\jujWtlV.exe
  C:\Windows\System\jujWtlV.exe
  2⤵
  PID:8916
- C:\Windows\System\eYsRKSd.exe
  C:\Windows\System\eYsRKSd.exe
  2⤵
  PID:428
- C:\Windows\System\xHBZvum.exe
  C:\Windows\System\xHBZvum.exe
  2⤵
  PID:9020
- C:\Windows\System\CwVebAU.exe
  C:\Windows\System\CwVebAU.exe
  2⤵
  PID:9092
- C:\Windows\System\PGaLqsY.exe
  C:\Windows\System\PGaLqsY.exe
  2⤵
  PID:9156
- C:\Windows\System\mVglzQb.exe
  C:\Windows\System\mVglzQb.exe
  2⤵
  PID:8260
- C:\Windows\System\tMRMfSw.exe
  C:\Windows\System\tMRMfSw.exe
  2⤵
  PID:8424
- C:\Windows\System\jfHonvh.exe
  C:\Windows\System\jfHonvh.exe
  2⤵
  PID:8504
- C:\Windows\System\SQZvcaA.exe
  C:\Windows\System\SQZvcaA.exe
  2⤵
  PID:8580
- C:\Windows\System\hrSSKDg.exe
  C:\Windows\System\hrSSKDg.exe
  2⤵
  PID:8708
- C:\Windows\System\RZOkTsA.exe
  C:\Windows\System\RZOkTsA.exe
  2⤵
  PID:8972
- C:\Windows\System\NVWLGpC.exe
  C:\Windows\System\NVWLGpC.exe
  2⤵
  PID:9120
- C:\Windows\System\EGkfMIa.exe
  C:\Windows\System\EGkfMIa.exe
  2⤵
  PID:8392
- C:\Windows\System\oOQOHVe.exe
  C:\Windows\System\oOQOHVe.exe
  2⤵
  PID:8744
- C:\Windows\System\yOVORwE.exe
  C:\Windows\System\yOVORwE.exe
  2⤵
  PID:8636
- C:\Windows\System\SCplVKC.exe
  C:\Windows\System\SCplVKC.exe
  2⤵
  PID:8304
- C:\Windows\System\yFqBXHL.exe
  C:\Windows\System\yFqBXHL.exe
  2⤵
  PID:9100
- C:\Windows\System\wFmVGcC.exe
  C:\Windows\System\wFmVGcC.exe
  2⤵
  PID:9228
- C:\Windows\System\nkAtqXO.exe
  C:\Windows\System\nkAtqXO.exe
  2⤵
  PID:9268
- C:\Windows\System\mFhEeYy.exe
  C:\Windows\System\mFhEeYy.exe
  2⤵
  PID:9296
- C:\Windows\System\ibPsoQG.exe
  C:\Windows\System\ibPsoQG.exe
  2⤵
  PID:9324
- C:\Windows\System\feRTGJA.exe
  C:\Windows\System\feRTGJA.exe
  2⤵
  PID:9344
- C:\Windows\System\rAjLyzl.exe
  C:\Windows\System\rAjLyzl.exe
  2⤵
  PID:9360
- C:\Windows\System\sQtImIx.exe
  C:\Windows\System\sQtImIx.exe
  2⤵
  PID:9408
- C:\Windows\System\AbMiJGR.exe
  C:\Windows\System\AbMiJGR.exe
  2⤵
  PID:9436
- C:\Windows\System\eNBkWQQ.exe
  C:\Windows\System\eNBkWQQ.exe
  2⤵
  PID:9460
- C:\Windows\System\GNsKDnr.exe
  C:\Windows\System\GNsKDnr.exe
  2⤵
  PID:9484
- C:\Windows\System\HwVeyjb.exe
  C:\Windows\System\HwVeyjb.exe
  2⤵
  PID:9512
- C:\Windows\System\TbiZEuG.exe
  C:\Windows\System\TbiZEuG.exe
  2⤵
  PID:9540
- C:\Windows\System\YkzhzDa.exe
  C:\Windows\System\YkzhzDa.exe
  2⤵
  PID:9568
- C:\Windows\System\ijEuiGF.exe
  C:\Windows\System\ijEuiGF.exe
  2⤵
  PID:9596
- C:\Windows\System\GhFnjGi.exe
  C:\Windows\System\GhFnjGi.exe
  2⤵
  PID:9620
- C:\Windows\System\bmkCmec.exe
  C:\Windows\System\bmkCmec.exe
  2⤵
  PID:9648
- C:\Windows\System\sliUuaz.exe
  C:\Windows\System\sliUuaz.exe
  2⤵
  PID:9692
- C:\Windows\System\NZXrebA.exe
  C:\Windows\System\NZXrebA.exe
  2⤵
  PID:9720
- C:\Windows\System\KFwDHAP.exe
  C:\Windows\System\KFwDHAP.exe
  2⤵
  PID:9748
- C:\Windows\System\GxnwWsT.exe
  C:\Windows\System\GxnwWsT.exe
  2⤵
  PID:9764
- C:\Windows\System\kTDCYkm.exe
  C:\Windows\System\kTDCYkm.exe
  2⤵
  PID:9792
- C:\Windows\System\MrkWLKI.exe
  C:\Windows\System\MrkWLKI.exe
  2⤵
  PID:9820
- C:\Windows\System\NxEKLBY.exe
  C:\Windows\System\NxEKLBY.exe
  2⤵
  PID:9848
- C:\Windows\System\ubiIQVi.exe
  C:\Windows\System\ubiIQVi.exe
  2⤵
  PID:9876
- C:\Windows\System\KPHsRlW.exe
  C:\Windows\System\KPHsRlW.exe
  2⤵
  PID:9900
- C:\Windows\System\YNjLzzg.exe
  C:\Windows\System\YNjLzzg.exe
  2⤵
  PID:9920
- C:\Windows\System\oibfLtg.exe
  C:\Windows\System\oibfLtg.exe
  2⤵
  PID:9956
- C:\Windows\System\mLliHze.exe
  C:\Windows\System\mLliHze.exe
  2⤵
  PID:9988
- C:\Windows\System\vGFqvnS.exe
  C:\Windows\System\vGFqvnS.exe
  2⤵
  PID:10024
- C:\Windows\System\metvhqF.exe
  C:\Windows\System\metvhqF.exe
  2⤵
  PID:10056
- C:\Windows\System\DBnRbaz.exe
  C:\Windows\System\DBnRbaz.exe
  2⤵
  PID:10076
- C:\Windows\System\LuPJvrM.exe
  C:\Windows\System\LuPJvrM.exe
  2⤵
  PID:10112
- C:\Windows\System\ZVlfEgW.exe
  C:\Windows\System\ZVlfEgW.exe
  2⤵
  PID:10140
- C:\Windows\System\OWTOHUb.exe
  C:\Windows\System\OWTOHUb.exe
  2⤵
  PID:10168
- C:\Windows\System\EaFTPbv.exe
  C:\Windows\System\EaFTPbv.exe
  2⤵
  PID:10196
- C:\Windows\System\fkPHOkK.exe
  C:\Windows\System\fkPHOkK.exe
  2⤵
  PID:10224
- C:\Windows\System\LJxlYRp.exe
  C:\Windows\System\LJxlYRp.exe
  2⤵
  PID:9224
- C:\Windows\System\MGTAYUf.exe
  C:\Windows\System\MGTAYUf.exe
  2⤵
  PID:9312
- C:\Windows\System\EWMCHnA.exe
  C:\Windows\System\EWMCHnA.exe
  2⤵
  PID:9392
- C:\Windows\System\YpwYNSE.exe
  C:\Windows\System\YpwYNSE.exe
  2⤵
  PID:9452
- C:\Windows\System\VnpymUn.exe
  C:\Windows\System\VnpymUn.exe
  2⤵
  PID:9492
- C:\Windows\System\CTRVXzQ.exe
  C:\Windows\System\CTRVXzQ.exe
  2⤵
  PID:9548
- C:\Windows\System\lFcEJYt.exe
  C:\Windows\System\lFcEJYt.exe
  2⤵
  PID:9592
- C:\Windows\System\pJYujAh.exe
  C:\Windows\System\pJYujAh.exe
  2⤵
  PID:9684
- C:\Windows\System\QRGRcYx.exe
  C:\Windows\System\QRGRcYx.exe
  2⤵
  PID:9740
- C:\Windows\System\xsFgZQA.exe
  C:\Windows\System\xsFgZQA.exe
  2⤵
  PID:9836
- C:\Windows\System\MNhEVQL.exe
  C:\Windows\System\MNhEVQL.exe
  2⤵
  PID:9888
- C:\Windows\System\gEolRwG.exe
  C:\Windows\System\gEolRwG.exe
  2⤵
  PID:9944
- C:\Windows\System\FJSCohu.exe
  C:\Windows\System\FJSCohu.exe
  2⤵
  PID:10016
- C:\Windows\System\weptltY.exe
  C:\Windows\System\weptltY.exe
  2⤵
  PID:10096
- C:\Windows\System\LeArUoI.exe
  C:\Windows\System\LeArUoI.exe
  2⤵
  PID:10160
- C:\Windows\System\xCJZMWm.exe
  C:\Windows\System\xCJZMWm.exe
  2⤵
  PID:10216
- C:\Windows\System\KhROVZP.exe
  C:\Windows\System\KhROVZP.exe
  2⤵
  PID:9260
- C:\Windows\System\GstXklA.exe
  C:\Windows\System\GstXklA.exe
  2⤵
  PID:9420
- C:\Windows\System\SJNaEUX.exe
  C:\Windows\System\SJNaEUX.exe
  2⤵
  PID:9608
- C:\Windows\System\BXYbEcV.exe
  C:\Windows\System\BXYbEcV.exe
  2⤵
  PID:9816
- C:\Windows\System\cFCqfYS.exe
  C:\Windows\System\cFCqfYS.exe
  2⤵
  PID:9868
- C:\Windows\System\maKvInI.exe
  C:\Windows\System\maKvInI.exe
  2⤵
  PID:9148
- C:\Windows\System\bpLvTqx.exe
  C:\Windows\System\bpLvTqx.exe
  2⤵
  PID:10212
- C:\Windows\System\XWjHfTS.exe
  C:\Windows\System\XWjHfTS.exe
  2⤵
  PID:9472
- C:\Windows\System\HlbSeYV.exe
  C:\Windows\System\HlbSeYV.exe
  2⤵
  PID:9780
- C:\Windows\System\eZDskwM.exe
  C:\Windows\System\eZDskwM.exe
  2⤵
  PID:10236
- C:\Windows\System\FMBXJqv.exe
  C:\Windows\System\FMBXJqv.exe
  2⤵
  PID:9468
- C:\Windows\System\TEBSsAk.exe
  C:\Windows\System\TEBSsAk.exe
  2⤵
  PID:9636
- C:\Windows\System\fmjKuaM.exe
  C:\Windows\System\fmjKuaM.exe
  2⤵
  PID:10264
- C:\Windows\System\UCluSmw.exe
  C:\Windows\System\UCluSmw.exe
  2⤵
  PID:10304
- C:\Windows\System\NsTYeeQ.exe
  C:\Windows\System\NsTYeeQ.exe
  2⤵
  PID:10320
- C:\Windows\System\mtGUcMb.exe
  C:\Windows\System\mtGUcMb.exe
  2⤵
  PID:10348
- C:\Windows\System\dwGgQtO.exe
  C:\Windows\System\dwGgQtO.exe
  2⤵
  PID:10384
- C:\Windows\System\DnSTitD.exe
  C:\Windows\System\DnSTitD.exe
  2⤵
  PID:10404
- C:\Windows\System\kTeAHSV.exe
  C:\Windows\System\kTeAHSV.exe
  2⤵
  PID:10436
- C:\Windows\System\tNkfaVB.exe
  C:\Windows\System\tNkfaVB.exe
  2⤵
  PID:10472
- C:\Windows\System\nadpyWY.exe
  C:\Windows\System\nadpyWY.exe
  2⤵
  PID:10500
- C:\Windows\System\EbWrOgD.exe
  C:\Windows\System\EbWrOgD.exe
  2⤵
  PID:10528
- C:\Windows\System\FlUgVhj.exe
  C:\Windows\System\FlUgVhj.exe
  2⤵
  PID:10544
- C:\Windows\System\nblHbuZ.exe
  C:\Windows\System\nblHbuZ.exe
  2⤵
  PID:10572
- C:\Windows\System\dbnjnfx.exe
  C:\Windows\System\dbnjnfx.exe
  2⤵
  PID:10612
- C:\Windows\System\niqRZjb.exe
  C:\Windows\System\niqRZjb.exe
  2⤵
  PID:10640
- C:\Windows\System\NPURqVl.exe
  C:\Windows\System\NPURqVl.exe
  2⤵
  PID:10664
- C:\Windows\System\VArzHFN.exe
  C:\Windows\System\VArzHFN.exe
  2⤵
  PID:10692
- C:\Windows\System\WSvrTKs.exe
  C:\Windows\System\WSvrTKs.exe
  2⤵
  PID:10716
- C:\Windows\System\PlPHtJM.exe
  C:\Windows\System\PlPHtJM.exe
  2⤵
  PID:10752
- C:\Windows\System\bALUNfw.exe
  C:\Windows\System\bALUNfw.exe
  2⤵
  PID:10780
- C:\Windows\System\GmVNUTN.exe
  C:\Windows\System\GmVNUTN.exe
  2⤵
  PID:10796
- C:\Windows\System\mqKFRyZ.exe
  C:\Windows\System\mqKFRyZ.exe
  2⤵
  PID:10824
- C:\Windows\System\HncQrux.exe
  C:\Windows\System\HncQrux.exe
  2⤵
  PID:10864
- C:\Windows\System\NuOpphg.exe
  C:\Windows\System\NuOpphg.exe
  2⤵
  PID:10880
- C:\Windows\System\vXtgZdA.exe
  C:\Windows\System\vXtgZdA.exe
  2⤵
  PID:10920
- C:\Windows\System\CaJxLKe.exe
  C:\Windows\System\CaJxLKe.exe
  2⤵
  PID:10936
- C:\Windows\System\vueYqPz.exe
  C:\Windows\System\vueYqPz.exe
  2⤵
  PID:10976
- C:\Windows\System\bByRaFK.exe
  C:\Windows\System\bByRaFK.exe
  2⤵
  PID:11004
- C:\Windows\System\GydXIug.exe
  C:\Windows\System\GydXIug.exe
  2⤵
  PID:11036
- C:\Windows\System\NLJGWUj.exe
  C:\Windows\System\NLJGWUj.exe
  2⤵
  PID:11064
- C:\Windows\System\ukkZWhX.exe
  C:\Windows\System\ukkZWhX.exe
  2⤵
  PID:11092
- C:\Windows\System\ssWmCvV.exe
  C:\Windows\System\ssWmCvV.exe
  2⤵
  PID:11108
- C:\Windows\System\JEAoDUE.exe
  C:\Windows\System\JEAoDUE.exe
  2⤵
  PID:11136
- C:\Windows\System\XKcfwUk.exe
  C:\Windows\System\XKcfwUk.exe
  2⤵
  PID:11164
- C:\Windows\System\aWZULim.exe
  C:\Windows\System\aWZULim.exe
  2⤵
  PID:11204
- C:\Windows\System\dbPTjrt.exe
  C:\Windows\System\dbPTjrt.exe
  2⤵
  PID:11232
- C:\Windows\System\SCxGNMr.exe
  C:\Windows\System\SCxGNMr.exe
  2⤵
  PID:11260
- C:\Windows\System\zvnIBee.exe
  C:\Windows\System\zvnIBee.exe
  2⤵
  PID:10292
- C:\Windows\System\ctdbLrV.exe
  C:\Windows\System\ctdbLrV.exe
  2⤵
  PID:10336
- C:\Windows\System\FrqWRoW.exe
  C:\Windows\System\FrqWRoW.exe
  2⤵
  PID:10424
- C:\Windows\System\AFwtPrB.exe
  C:\Windows\System\AFwtPrB.exe
  2⤵
  PID:10460
- C:\Windows\System\CPKkfhE.exe
  C:\Windows\System\CPKkfhE.exe
  2⤵
  PID:10536
- C:\Windows\System\JcyxAoU.exe
  C:\Windows\System\JcyxAoU.exe
  2⤵
  PID:10600
- C:\Windows\System\AkdsCGA.exe
  C:\Windows\System\AkdsCGA.exe
  2⤵
  PID:10684
- C:\Windows\System\ywwsrAd.exe
  C:\Windows\System\ywwsrAd.exe
  2⤵
  PID:10748
- C:\Windows\System\lluGYKZ.exe
  C:\Windows\System\lluGYKZ.exe
  2⤵
  PID:10812
- C:\Windows\System\uqQIOYE.exe
  C:\Windows\System\uqQIOYE.exe
  2⤵
  PID:10872
- C:\Windows\System\qTPVXVr.exe
  C:\Windows\System\qTPVXVr.exe
  2⤵
  PID:10916
- C:\Windows\System\MVxHBcN.exe
  C:\Windows\System\MVxHBcN.exe
  2⤵
  PID:10972
- C:\Windows\System\aquAESz.exe
  C:\Windows\System\aquAESz.exe
  2⤵
  PID:4636
- C:\Windows\System\djSNFoR.exe
  C:\Windows\System\djSNFoR.exe
  2⤵
  PID:11084
- C:\Windows\System\YiHkGZq.exe
  C:\Windows\System\YiHkGZq.exe
  2⤵
  PID:11152
- C:\Windows\System\nDOEimR.exe
  C:\Windows\System\nDOEimR.exe
  2⤵
  PID:11220
- C:\Windows\System\esFiEYk.exe
  C:\Windows\System\esFiEYk.exe
  2⤵
  PID:10260
- C:\Windows\System\IkMUUqx.exe
  C:\Windows\System\IkMUUqx.exe
  2⤵
  PID:10456
- C:\Windows\System\qgkrzTA.exe
  C:\Windows\System\qgkrzTA.exe
  2⤵
  PID:10656
- C:\Windows\System\aMIygXY.exe
  C:\Windows\System\aMIygXY.exe
  2⤵
  PID:10788
- C:\Windows\System\AvlQDQr.exe
  C:\Windows\System\AvlQDQr.exe
  2⤵
  PID:10952
- C:\Windows\System\LdDKmou.exe
  C:\Windows\System\LdDKmou.exe
  2⤵
  PID:11160
- C:\Windows\System\YfsqlHy.exe
  C:\Windows\System\YfsqlHy.exe
  2⤵
  PID:10496
- C:\Windows\System\vnMlVOW.exe
  C:\Windows\System\vnMlVOW.exe
  2⤵
  PID:11012
- C:\Windows\System\QHTiCIv.exe
  C:\Windows\System\QHTiCIv.exe
  2⤵
  PID:10256
- C:\Windows\System\mhUzzWo.exe
  C:\Windows\System\mhUzzWo.exe
  2⤵
  PID:10372
- C:\Windows\System\cYzqjcu.exe
  C:\Windows\System\cYzqjcu.exe
  2⤵
  PID:11292
- C:\Windows\System\XFgOPFc.exe
  C:\Windows\System\XFgOPFc.exe
  2⤵
  PID:11308
- C:\Windows\System\capuZGu.exe
  C:\Windows\System\capuZGu.exe
  2⤵
  PID:11336
- C:\Windows\System\saTzOel.exe
  C:\Windows\System\saTzOel.exe
  2⤵
  PID:11384
- C:\Windows\System\enBcvZn.exe
  C:\Windows\System\enBcvZn.exe
  2⤵
  PID:11408
- C:\Windows\System\brvpGqh.exe
  C:\Windows\System\brvpGqh.exe
  2⤵
  PID:11448
- C:\Windows\System\jpOdznC.exe
  C:\Windows\System\jpOdznC.exe
  2⤵
  PID:11484
- C:\Windows\System\lOkUtuQ.exe
  C:\Windows\System\lOkUtuQ.exe
  2⤵
  PID:11528
- C:\Windows\System\litteOQ.exe
  C:\Windows\System\litteOQ.exe
  2⤵
  PID:11544
- C:\Windows\System\ZmYjgsw.exe
  C:\Windows\System\ZmYjgsw.exe
  2⤵
  PID:11584
- C:\Windows\System\wArgRLD.exe
  C:\Windows\System\wArgRLD.exe
  2⤵
  PID:11616
- C:\Windows\System\MLRxiyS.exe
  C:\Windows\System\MLRxiyS.exe
  2⤵
  PID:11632
- C:\Windows\System\uIPJVLA.exe
  C:\Windows\System\uIPJVLA.exe
  2⤵
  PID:11660
- C:\Windows\System\lgeeWRn.exe
  C:\Windows\System\lgeeWRn.exe
  2⤵
  PID:11688
- C:\Windows\System\JgEkMbO.exe
  C:\Windows\System\JgEkMbO.exe
  2⤵
  PID:11728
- C:\Windows\System\guHJvSh.exe
  C:\Windows\System\guHJvSh.exe
  2⤵
  PID:11756
- C:\Windows\System\hJldfbY.exe
  C:\Windows\System\hJldfbY.exe
  2⤵
  PID:11788
- C:\Windows\System\zYeDyKP.exe
  C:\Windows\System\zYeDyKP.exe
  2⤵
  PID:11816
- C:\Windows\System\JgKhzIV.exe
  C:\Windows\System\JgKhzIV.exe
  2⤵
  PID:11852
- C:\Windows\System\QPgXtPZ.exe
  C:\Windows\System\QPgXtPZ.exe
  2⤵
  PID:11884
- C:\Windows\System\bezoTKL.exe
  C:\Windows\System\bezoTKL.exe
  2⤵
  PID:11912
- C:\Windows\System\APBvCMI.exe
  C:\Windows\System\APBvCMI.exe
  2⤵
  PID:11940
- C:\Windows\System\UEwzeAV.exe
  C:\Windows\System\UEwzeAV.exe
  2⤵
  PID:11968
- C:\Windows\System\UwaUDIV.exe
  C:\Windows\System\UwaUDIV.exe
  2⤵
  PID:11996
- C:\Windows\System\tPXuqYk.exe
  C:\Windows\System\tPXuqYk.exe
  2⤵
  PID:12024
- C:\Windows\System\gGITavw.exe
  C:\Windows\System\gGITavw.exe
  2⤵
  PID:12052
- C:\Windows\System\TGZrxBx.exe
  C:\Windows\System\TGZrxBx.exe
  2⤵
  PID:12080
- C:\Windows\System\lMVZOMp.exe
  C:\Windows\System\lMVZOMp.exe
  2⤵
  PID:12104
- C:\Windows\System\CHByvjy.exe
  C:\Windows\System\CHByvjy.exe
  2⤵
  PID:12132
- C:\Windows\System\adktArb.exe
  C:\Windows\System\adktArb.exe
  2⤵
  PID:12164
- C:\Windows\System\KGsKSSp.exe
  C:\Windows\System\KGsKSSp.exe
  2⤵
  PID:12192
- C:\Windows\System\zpyVOrR.exe
  C:\Windows\System\zpyVOrR.exe
  2⤵
  PID:12220
- C:\Windows\System\ucgwouU.exe
  C:\Windows\System\ucgwouU.exe
  2⤵
  PID:12244
- C:\Windows\System\bpFmBWH.exe
  C:\Windows\System\bpFmBWH.exe
  2⤵
  PID:12264
- C:\Windows\System\iXGpCGq.exe
  C:\Windows\System\iXGpCGq.exe
  2⤵
  PID:11284
- C:\Windows\System\qMCkAYs.exe
  C:\Windows\System\qMCkAYs.exe
  2⤵
  PID:11320
- C:\Windows\System\iXmfNBq.exe
  C:\Windows\System\iXmfNBq.exe
  2⤵
  PID:11392
- C:\Windows\System\xoVqrQZ.exe
  C:\Windows\System\xoVqrQZ.exe
  2⤵
  PID:11520
- C:\Windows\System\qgamSQR.exe
  C:\Windows\System\qgamSQR.exe
  2⤵
  PID:11580
- C:\Windows\System\wwZTSVG.exe
  C:\Windows\System\wwZTSVG.exe
  2⤵
  PID:11644
- C:\Windows\System\CsiRmQw.exe
  C:\Windows\System\CsiRmQw.exe
  2⤵
  PID:11716
- C:\Windows\System\Enhxhkd.exe
  C:\Windows\System\Enhxhkd.exe
  2⤵
  PID:11748
- C:\Windows\System\UDxsQpl.exe
  C:\Windows\System\UDxsQpl.exe
  2⤵
  PID:11868
- C:\Windows\System\rIzfPqe.exe
  C:\Windows\System\rIzfPqe.exe
  2⤵
  PID:11924
- C:\Windows\System\PTOndcc.exe
  C:\Windows\System\PTOndcc.exe
  2⤵
  PID:11980
- C:\Windows\System\YzyMzCK.exe
  C:\Windows\System\YzyMzCK.exe
  2⤵
  PID:12048
- C:\Windows\System\VUrjyQv.exe
  C:\Windows\System\VUrjyQv.exe
  2⤵
  PID:12096
- C:\Windows\System\dIuJSWc.exe
  C:\Windows\System\dIuJSWc.exe
  2⤵
  PID:12188
- C:\Windows\System\cKfYdMa.exe
  C:\Windows\System\cKfYdMa.exe
  2⤵
  PID:12276
- C:\Windows\System\LxGdrRO.exe
  C:\Windows\System\LxGdrRO.exe
  2⤵
  PID:11380
- C:\Windows\System\PAEdkpA.exe
  C:\Windows\System\PAEdkpA.exe
  2⤵
  PID:11536
- C:\Windows\System\KOaNVMQ.exe
  C:\Windows\System\KOaNVMQ.exe
  2⤵
  PID:11724
- C:\Windows\System\UFOwVye.exe
  C:\Windows\System\UFOwVye.exe
  2⤵
  PID:11860
- C:\Windows\System\DZhtnZX.exe
  C:\Windows\System\DZhtnZX.exe
  2⤵
  PID:12036
- C:\Windows\System\xZWfzLE.exe
  C:\Windows\System\xZWfzLE.exe
  2⤵
  PID:11332
- C:\Windows\System\zltPAhi.exe
  C:\Windows\System\zltPAhi.exe
  2⤵
  PID:12020
- C:\Windows\System\bQOdKGW.exe
  C:\Windows\System\bQOdKGW.exe
  2⤵
  PID:11612
- C:\Windows\System\qwfCWXM.exe
  C:\Windows\System\qwfCWXM.exe
  2⤵
  PID:12300
- C:\Windows\System\aNynFWA.exe
  C:\Windows\System\aNynFWA.exe
  2⤵
  PID:12320
- C:\Windows\System\jPgdodj.exe
  C:\Windows\System\jPgdodj.exe
  2⤵
  PID:12352
- C:\Windows\System\JZlJURp.exe
  C:\Windows\System\JZlJURp.exe
  2⤵
  PID:12380
- C:\Windows\System\IYcsTbv.exe
  C:\Windows\System\IYcsTbv.exe
  2⤵
  PID:12404
- C:\Windows\System\dLmCesG.exe
  C:\Windows\System\dLmCesG.exe
  2⤵
  PID:12460
- C:\Windows\System\whvHsgc.exe
  C:\Windows\System\whvHsgc.exe
  2⤵
  PID:12500
- C:\Windows\System\xcQzxVk.exe
  C:\Windows\System\xcQzxVk.exe
  2⤵
  PID:12528
- C:\Windows\System\ChvqXPW.exe
  C:\Windows\System\ChvqXPW.exe
  2⤵
  PID:12564
- C:\Windows\System\tTKGwus.exe
  C:\Windows\System\tTKGwus.exe
  2⤵
  PID:12620
- C:\Windows\System\MCksUvv.exe
  C:\Windows\System\MCksUvv.exe
  2⤵
  PID:12636
- C:\Windows\System\DzoXlVx.exe
  C:\Windows\System\DzoXlVx.exe
  2⤵
  PID:12684
- C:\Windows\System\BWDNAqX.exe
  C:\Windows\System\BWDNAqX.exe
  2⤵
  PID:12716
- C:\Windows\System\UNjVDZw.exe
  C:\Windows\System\UNjVDZw.exe
  2⤵
  PID:12744
- C:\Windows\System\RaPgjxO.exe
  C:\Windows\System\RaPgjxO.exe
  2⤵
  PID:12772
- C:\Windows\System\kCeRRFo.exe
  C:\Windows\System\kCeRRFo.exe
  2⤵
  PID:12796
- C:\Windows\System\haFvvvM.exe
  C:\Windows\System\haFvvvM.exe
  2⤵
  PID:12828
- C:\Windows\System\DnstYJH.exe
  C:\Windows\System\DnstYJH.exe
  2⤵
  PID:12856
- C:\Windows\System\HaslvAT.exe
  C:\Windows\System\HaslvAT.exe
  2⤵
  PID:12896
- C:\Windows\System\zOmyyCY.exe
  C:\Windows\System\zOmyyCY.exe
  2⤵
  PID:12924
- C:\Windows\System\vJFXjnR.exe
  C:\Windows\System\vJFXjnR.exe
  2⤵
  PID:12952
- C:\Windows\System\ZMQBiPt.exe
  C:\Windows\System\ZMQBiPt.exe
  2⤵
  PID:12984
- C:\Windows\System\oixgRED.exe
  C:\Windows\System\oixgRED.exe
  2⤵
  PID:13008
- C:\Windows\System\SkASYgL.exe
  C:\Windows\System\SkASYgL.exe
  2⤵
  PID:13032
- C:\Windows\System\QLpjbTb.exe
  C:\Windows\System\QLpjbTb.exe
  2⤵
  PID:13080
- C:\Windows\System\xHboqFX.exe
  C:\Windows\System\xHboqFX.exe
  2⤵
  PID:13104
- C:\Windows\System\hQRPOJx.exe
  C:\Windows\System\hQRPOJx.exe
  2⤵
  PID:13136
- C:\Windows\System\azmRrCE.exe
  C:\Windows\System\azmRrCE.exe
  2⤵
  PID:13152
- C:\Windows\System\KVWHiwf.exe
  C:\Windows\System\KVWHiwf.exe
  2⤵
  PID:13184
- C:\Windows\System\MIjxAHs.exe
  C:\Windows\System\MIjxAHs.exe
  2⤵
  PID:13208
- C:\Windows\System\VFWiyRy.exe
  C:\Windows\System\VFWiyRy.exe
  2⤵
  PID:13240
- C:\Windows\System\GRxhzNI.exe
  C:\Windows\System\GRxhzNI.exe
  2⤵
  PID:13272
- C:\Windows\System\YjgatkO.exe
  C:\Windows\System\YjgatkO.exe
  2⤵
  PID:12176
- C:\Windows\System\BDjEtLB.exe
  C:\Windows\System\BDjEtLB.exe
  2⤵
  PID:12376
- C:\Windows\System\nyoqgeA.exe
  C:\Windows\System\nyoqgeA.exe
  2⤵
  PID:12400
- C:\Windows\System\AQozwBd.exe
  C:\Windows\System\AQozwBd.exe
  2⤵
  PID:12512
- C:\Windows\System\kZMVDsF.exe
  C:\Windows\System\kZMVDsF.exe
  2⤵
  PID:12596
- C:\Windows\System\CzoerVC.exe
  C:\Windows\System\CzoerVC.exe
  2⤵
  PID:12664
- C:\Windows\System\lAyWhgP.exe
  C:\Windows\System\lAyWhgP.exe
  2⤵
  PID:12740
- C:\Windows\System\tgoQigq.exe
  C:\Windows\System\tgoQigq.exe
  2⤵
  PID:12788
- C:\Windows\System\ItyPfEw.exe
  C:\Windows\System\ItyPfEw.exe
  2⤵
  PID:12912
- C:\Windows\System\WcBVErM.exe
  C:\Windows\System\WcBVErM.exe
  2⤵
  PID:12964
- C:\Windows\System\hAEVuDH.exe
  C:\Windows\System\hAEVuDH.exe
  2⤵
  PID:13028
- C:\Windows\System\TVwqwyY.exe
  C:\Windows\System\TVwqwyY.exe
  2⤵
  PID:13128
- C:\Windows\System\GjgYEVv.exe
  C:\Windows\System\GjgYEVv.exe
  2⤵
  PID:13168
- C:\Windows\System\NvxQliS.exe
  C:\Windows\System\NvxQliS.exe
  2⤵
  PID:13252
- C:\Windows\System\eJIhAuQ.exe
  C:\Windows\System\eJIhAuQ.exe
  2⤵
  PID:13284
- C:\Windows\System\pSwNeuG.exe
  C:\Windows\System\pSwNeuG.exe
  2⤵
  PID:12548
- C:\Windows\System\DwNVpyi.exe
  C:\Windows\System\DwNVpyi.exe
  2⤵
  PID:12852
- C:\Windows\System\AYLdoLv.exe
  C:\Windows\System\AYLdoLv.exe
  2⤵
  PID:12944
- C:\Windows\System\QCASjEi.exe
  C:\Windows\System\QCASjEi.exe
  2⤵
  PID:13088
- C:\Windows\System\RwXKNIT.exe
  C:\Windows\System\RwXKNIT.exe
  2⤵
  PID:13196
- C:\Windows\System\fHmOmze.exe
  C:\Windows\System\fHmOmze.exe
  2⤵
  PID:12652
- C:\Windows\System\IhQwYTD.exe
  C:\Windows\System\IhQwYTD.exe
  2⤵
  PID:13096
- C:\Windows\System\giJsUrs.exe
  C:\Windows\System\giJsUrs.exe
  2⤵
  PID:12808
- C:\Windows\System\ktJMJmZ.exe
  C:\Windows\System\ktJMJmZ.exe
  2⤵
  PID:13328
- C:\Windows\System\CXgXKPu.exe
  C:\Windows\System\CXgXKPu.exe
  2⤵
  PID:13360
- C:\Windows\System\abYnXER.exe
  C:\Windows\System\abYnXER.exe
  2⤵
  PID:13388
- C:\Windows\System\FlHsrBd.exe
  C:\Windows\System\FlHsrBd.exe
  2⤵
  PID:13416
- C:\Windows\System\fPCdBYs.exe
  C:\Windows\System\fPCdBYs.exe
  2⤵
  PID:13444
- C:\Windows\System\RjiYvLm.exe
  C:\Windows\System\RjiYvLm.exe
  2⤵
  PID:13472
- C:\Windows\System\QNvjwyN.exe
  C:\Windows\System\QNvjwyN.exe
  2⤵
  PID:13496
- C:\Windows\System\bLQTyjH.exe
  C:\Windows\System\bLQTyjH.exe
  2⤵
  PID:13512
- C:\Windows\System\lIpskWk.exe
  C:\Windows\System\lIpskWk.exe
  2⤵
  PID:13544
- C:\Windows\System\uvXURbz.exe
  C:\Windows\System\uvXURbz.exe
  2⤵
  PID:13584
- C:\Windows\System\wYmYzre.exe
  C:\Windows\System\wYmYzre.exe
  2⤵
  PID:13612
- C:\Windows\System\lshEoyV.exe
  C:\Windows\System\lshEoyV.exe
  2⤵
  PID:13628
- C:\Windows\System\UMKUYnO.exe
  C:\Windows\System\UMKUYnO.exe
  2⤵
  PID:13644
- C:\Windows\System\nyZhTer.exe
  C:\Windows\System\nyZhTer.exe
  2⤵
  PID:13692
- C:\Windows\System\JCOSEVA.exe
  C:\Windows\System\JCOSEVA.exe
  2⤵
  PID:13732
- C:\Windows\System\DKsOFTM.exe
  C:\Windows\System\DKsOFTM.exe
  2⤵
  PID:13760
- C:\Windows\System\HozqeIK.exe
  C:\Windows\System\HozqeIK.exe
  2⤵
  PID:13788
- C:\Windows\System\gUSlgJe.exe
  C:\Windows\System\gUSlgJe.exe
  2⤵
  PID:13816
- C:\Windows\System\EtcdtAL.exe
  C:\Windows\System\EtcdtAL.exe
  2⤵
  PID:13832
- C:\Windows\System\qkqEHEY.exe
  C:\Windows\System\qkqEHEY.exe
  2⤵
  PID:13860
- C:\Windows\System\STqmtFM.exe
  C:\Windows\System\STqmtFM.exe
  2⤵
  PID:13892
- C:\Windows\System\xVsqpRB.exe
  C:\Windows\System\xVsqpRB.exe
  2⤵
  PID:13924
- C:\Windows\System\oIcVwIk.exe
  C:\Windows\System\oIcVwIk.exe
  2⤵
  PID:13956
- C:\Windows\System\RTJAgzo.exe
  C:\Windows\System\RTJAgzo.exe
  2⤵
  PID:13984
- C:\Windows\System\ziJCCuM.exe
  C:\Windows\System\ziJCCuM.exe
  2⤵
  PID:14012
- C:\Windows\System\PQqrbIv.exe
  C:\Windows\System\PQqrbIv.exe
  2⤵
  PID:14028
- C:\Windows\System\PCjXGvm.exe
  C:\Windows\System\PCjXGvm.exe
  2⤵
  PID:14060
- C:\Windows\System\ivfiNDO.exe
  C:\Windows\System\ivfiNDO.exe
  2⤵
  PID:14084
- C:\Windows\System\eepLRVp.exe
  C:\Windows\System\eepLRVp.exe
  2⤵
  PID:14112
- C:\Windows\System\noudvzc.exe
  C:\Windows\System\noudvzc.exe
  2⤵
  PID:14144
- C:\Windows\System\TfdxBYa.exe
  C:\Windows\System\TfdxBYa.exe
  2⤵
  PID:14168
- C:\Windows\System\EbOnlIR.exe
  C:\Windows\System\EbOnlIR.exe
  2⤵
  PID:14196
- C:\Windows\System\hUdRoTr.exe
  C:\Windows\System\hUdRoTr.exe
  2⤵
  PID:14224
- C:\Windows\System\UEtSAMq.exe
  C:\Windows\System\UEtSAMq.exe
  2⤵
  PID:14240
- C:\Windows\System\OGyJRJo.exe
  C:\Windows\System\OGyJRJo.exe
  2⤵
  PID:14276
- C:\Windows\System\okRyIYD.exe
  C:\Windows\System\okRyIYD.exe
  2⤵
  PID:14308
- C:\Windows\System\ZSZJzqj.exe
  C:\Windows\System\ZSZJzqj.exe
  2⤵
  PID:14324
- C:\Windows\System\uHrUmja.exe
  C:\Windows\System\uHrUmja.exe
  2⤵
  PID:13324
- C:\Windows\System\koObkbp.exe
  C:\Windows\System\koObkbp.exe
  2⤵
  PID:13380
- C:\Windows\System\AzsVURb.exe
  C:\Windows\System\AzsVURb.exe
  2⤵
  PID:13456
- C:\Windows\System\RMmlWNs.exe
  C:\Windows\System\RMmlWNs.exe
  2⤵
  PID:13508
- C:\Windows\System\IrzdwHS.exe
  C:\Windows\System\IrzdwHS.exe
  2⤵
  PID:3496
- C:\Windows\System\UkXlMnB.exe
  C:\Windows\System\UkXlMnB.exe
  2⤵
  PID:13636
- C:\Windows\System\LKnuGEi.exe
  C:\Windows\System\LKnuGEi.exe
  2⤵
  PID:13704
- C:\Windows\System\hjDQDYJ.exe
  C:\Windows\System\hjDQDYJ.exe
  2⤵
  PID:13744
- C:\Windows\System\HRvPNTk.exe
  C:\Windows\System\HRvPNTk.exe
  2⤵
  PID:13828
- C:\Windows\System\GkkmNUF.exe
  C:\Windows\System\GkkmNUF.exe
  2⤵
  PID:13916
- C:\Windows\System\NPUtzPe.exe
  C:\Windows\System\NPUtzPe.exe
  2⤵
  PID:13944
- C:\Windows\System\ixlJaRg.exe
  C:\Windows\System\ixlJaRg.exe
  2⤵
  PID:14076
- C:\Windows\System\bzIRnvj.exe
  C:\Windows\System\bzIRnvj.exe
  2⤵
  PID:14124
- C:\Windows\System\MDLuhqL.exe
  C:\Windows\System\MDLuhqL.exe
  2⤵
  PID:14152
- C:\Windows\System\zXCdGKB.exe
  C:\Windows\System\zXCdGKB.exe
  2⤵
  PID:14252
- C:\Windows\System\mNLJQpN.exe
  C:\Windows\System\mNLJQpN.exe
  2⤵
  PID:14264
- C:\Windows\System\cTEQdmZ.exe
  C:\Windows\System\cTEQdmZ.exe
  2⤵
  PID:13316
- C:\Windows\System\ShcyNZd.exe
  C:\Windows\System\ShcyNZd.exe
  2⤵
  PID:13356
- C:\Windows\System\piNdwxm.exe
  C:\Windows\System\piNdwxm.exe
  2⤵
  PID:13596
- C:\Windows\System\hFJXtPg.exe
  C:\Windows\System\hFJXtPg.exe
  2⤵
  PID:13728
- C:\Windows\System\FPKVWJS.exe
  C:\Windows\System\FPKVWJS.exe
  2⤵
  PID:13348
- C:\Windows\System\UBjsgwN.exe
  C:\Windows\System\UBjsgwN.exe
  2⤵
  PID:14068
- C:\Windows\System\FDZsnzA.exe
  C:\Windows\System\FDZsnzA.exe
  2⤵
  PID:14212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BZJmABT.exe

Filesize
2.3MB

MD5
adf7613bf913883c0f0b3f0757f8584b

SHA1
7610aa72ac0383e21052b3eb314b1d7aed4e78d9

SHA256
b4de19198853d560ab51cd418ae1501b4b2484ac4241a3b728cc884dd2abc631

SHA512
597912811df944835d7a9ab67df6b094ab4e3aeb28310fdaa57e138b8191bc0f162d17272bea138c5e430ff764e03583c116b6e01d5ba7c3d6ca5504a22e31d3

Download Submit
C:\Windows\System\BxIpgsv.exe

Filesize
2.3MB

MD5
aa0d7af6290f1d3c7c91f22991c6be14

SHA1
0ec5a7123119df63b8df54ceee8f4d63c1b9e0e2

SHA256
4d14d35ec4d59726f1d6227708cb99e16ceaa4ba11b4e0a5ffffaf94c019f0f9

SHA512
1db4b015271c0cd70d4c633e509d0a4c21b6ea00df223490367a3d1e0d2c14a9864aa62b5ce2ff6a683baec92f7d5a908493409678b60a0df57cfc9d87d34a62

Download Submit
C:\Windows\System\CqrmGQJ.exe

Filesize
2.3MB

MD5
5dd2d9b8bcf18fb72ec88e1f249371db

SHA1
a34ddea6ae882b41f8b020f4efcab150eb5a5724

SHA256
14cae6781346b62374a4a9dfe6f6bd348b8a9a38311b9ae540131e5e64f3d6fa

SHA512
b6ad5311fe081c660c58adf694c72d24ffe79ae7003a6fc1a6677a429e64b080cb5feb18f4a46747b5b0efc8bb677863bc2da81f9214ae277f50f77042057c21

Download Submit
C:\Windows\System\EJQqcsr.exe

Filesize
2.3MB

MD5
1691a17b54fac71139291c29eb5941c5

SHA1
096c3ac0aa8ed34f9dbedbbec2ccac30cd6b6881

SHA256
2920be3e3d6522cb16744242628bcd35a9fd044aeb0ada1c7083c99df0c3f7b8

SHA512
4425a92a36c51dd00c0463a14dff9b95af51f2ed0519dead1b4561049b643380fd1a90ea898e0b6216ca5a13f16dc60ec740d4b3063b5700b33c018895d48748

Download Submit
C:\Windows\System\GJbzkYz.exe

Filesize
2.3MB

MD5
86a49103900fdfb0adc75d9747e00d41

SHA1
e147aed8fd8d3ce0f0798847a9bc999abc783aa4

SHA256
f992f26b2850644e9bbdc464ad8a416ef7867ace89fe0a65b985c81271c5aac4

SHA512
40f408b1dc804b0648af1e17f0e2c39845966513eebbac1fa96f5c51f1ae6e1488bcf76b3552656b94e6c058806077459be1c38e0693fe2b3c586cdc6e328fc4

Download Submit
C:\Windows\System\GpTGpkm.exe

Filesize
2.3MB

MD5
2fd9a033078e78236cd19b4ead1cd49f

SHA1
84fb39146c0ea2f027f3aa28492be4463504863e

SHA256
5a4fede73c53b88d445a8e6310d8bd1b43eabce855813e64c88ea0345ebf387f

SHA512
418a5e70d82949af6e5c74074280e4a5429e2adaac4d9dc8f54141a9cd70d305c0e807931399b66b0178605b43df041631de9050f41b4d08903d7d0761bf0a89

Download Submit
C:\Windows\System\HKNOMxB.exe

Filesize
2.3MB

MD5
1ae231dbac591ea998b4aa3c378b5c5d

SHA1
e15d22c29cece0bb53ea5e1e2b93da9fa321265e

SHA256
ba9efe8afab6dfdbd22791bf20309b0a9e88f5f4fab6d3e8ca9eba74bb0f329e

SHA512
4c7bbc104471df1069a0af690c3a4a59c4a785accca9c6799c1254a9b3c24764bf6963e02df34c225666131d8804a1b1472b93fff1b781a08c55f3f48545aec3

Download Submit
C:\Windows\System\HwoRevs.exe

Filesize
2.3MB

MD5
6594fa9a88cfb380c9f069138662bd18

SHA1
8766e387a214340c465b8c212cf8c49c1041bdbe

SHA256
d5eca94822bbf3fff50f8fb71df95e344a00aca359c4071ccb4ae990f5e50f7a

SHA512
6a6f64d7d4bb1d2cfde2b9c347b6f1853a2414e6c57a9e421c5bf51377966b20c47da4b8e14ea7b9097129fda2b773028a67fc0a89d29283ac4233c66097857c

Download Submit
C:\Windows\System\KlNJDih.exe

Filesize
2.3MB

MD5
29ce51016518013cac9cb9f484056d8e

SHA1
6eaa032b5ef952bdb53d7fd8727d80f5c0748ad0

SHA256
262c3a29a4a8a30f5ac89f3e9b50567c39be3360b59820eec54868b239bd0efb

SHA512
5eb1f445410d879746295371d9afa388b955ca2e21567ce40c18d454d50467de4c1b40a518f7748710a2f8e6fc8924112f4d4a42f250781ec2d75f613d70763e

Download Submit
C:\Windows\System\LnCsyzj.exe

Filesize
2.3MB

MD5
fe3d2b24b0f08c476c59fcbf5932625f

SHA1
4f0f139c6069b5cf08c77c09f439785d91eb1847

SHA256
53944797630947f8ead244629fc5e669b5bb3fffa3b8f7aa448db734399d98bc

SHA512
54251010e849b88da288166d4daf14237d789736b12e381f71dff7b2e7304bbc28df1cce95a378815ae0c47ad38f099c6080fa7086bbdfb5d94226a21103d3b3

Download Submit
C:\Windows\System\MmqGORI.exe

Filesize
2.3MB

MD5
5979651e21ce1df3b850ecad85e8e52e

SHA1
5abc5a622706bbc25e7b2140f3e12d5a2674f07f

SHA256
a2516946ab298489fca9ef2b2382cdeff084bc495eb1593cb362d7e05c3c7c13

SHA512
17b5b3c10d7415ac817bcdece91bd9ae85f8015d579dcc7232188e3c8ca097ef24634ef8152e51dc38e886245b474684e8fb9505ef2080f570f55d6866c6a58d

Download Submit
C:\Windows\System\OzZfnpg.exe

Filesize
2.3MB

MD5
04df2c1e9516817142b52888d818728f

SHA1
e46d689a82a0006d4ff0aff4a9de8562a737682f

SHA256
675a21092399d79af685e3b02ce240fb1fedb36df29718a549ab69bb0ed14493

SHA512
8a13eb534d797944e8118f3f131b4c88eba11b7b4bb66ce989dea3447f3a25242c6ebeb934e5c16f313c6433ea74b58b4264a5d01aea1fccd0726af0ad1bf98e

Download Submit
C:\Windows\System\PdNQetN.exe

Filesize
2.3MB

MD5
4eb85738c5b3e27ca8711aa56b799572

SHA1
c5da91d99029b32c3e69c40488630dea238503f4

SHA256
1a4097221046f7dd2d2fd505f7911f0372668014fd8c6a55575422eea2d0d826

SHA512
0b0bae8d62efbadcb6b07d74b42a01e3928683301fd7d94cc1e02efe766fe91c8d6480605db85c4cd00c9778562ee7017966528a9c46ae0c5502ac17f3a5d36f

Download Submit
C:\Windows\System\QWAPKFL.exe

Filesize
2.3MB

MD5
0472c78e0166f7ce7a0d30ce0a6e90f2

SHA1
cc5511d000ee1a045465e5370776dc2645c31fd0

SHA256
ef1e10544d3ed607c079bfb90c121af26874ddd88ab4c92d416ed865fcae6028

SHA512
b2c377434c5e6546c6e704dd6efd0c26fc00ab0237918be93085b0afec12d7eeb1d3d8846f9faf34f8d277c2363c59d9556aa8d3e22bbb1f32c1045dda145b15

Download Submit
C:\Windows\System\RIKJWUi.exe

Filesize
2.3MB

MD5
3712c6ac3fe943895b1b8fe3fd75971b

SHA1
1bb3ddfb3d9e7220c2af5e71498be28da3aca289

SHA256
f5bd8f6716cda3c0acc26c524ed25c697fbe80c58dcb1b341f73c0bc262db2ab

SHA512
7afaafac7dfaaf53d66ae2797521dc3ac8c97823653f09f4660d694ab38058b641ce09f1192f2b21dd70edefd08fb495fd49e356bf937be65a7e50a92642bb4f

Download Submit
C:\Windows\System\UbAglqf.exe

Filesize
2.3MB

MD5
281c57a0bb8397c7a51f9362f565d863

SHA1
9a6e56afafefc62ac9a67a85d7b55ea17e1d79a3

SHA256
aae3655ed8ad1681a85e49922b8ccc0b1253481505df1daaf8b6b86c9e320605

SHA512
f9abb968dca568c16fcfd8f526016bd8df099e30919821fcc11aac5414e9a973467344e604eee1769ab725ab74664af6d930b435c9360cbe7979a6271c49bfa4

Download Submit
C:\Windows\System\VncHOkf.exe

Filesize
2.3MB

MD5
7379e28493f7bdd250c88449802b7579

SHA1
fa1a556479517258eaeb322d0923efb69d5b7f17

SHA256
c3d14a6befeab38b3001dc9f50ef2aa9d8def3489bd15dab04e178478999f08a

SHA512
7c92dd4c3ef9d994458d614a1c84cf8bd88d13e6c771993291fa6bb5acef581a5589a3e43a7ac27571d6a1372edca588eacbed62884d8c493df9f3095a677687

Download Submit
C:\Windows\System\XCNdMfd.exe

Filesize
2.3MB

MD5
c2f141d7586befd0cb5e3516d9406f4f

SHA1
872c907f9d97c66b7a827e0a3b88243e75f411c9

SHA256
38bef7423d88e6f2a75ce32b3531d1870006492025aee0b24aedfa2a0053cdab

SHA512
8c3650ad25f3a599c7c09fd46bc83cbbf23890342685f2d98d57d410e9ca3b98c68ad9624d103a56514b174b2ae2e1a0a30a2fcd7e167105a0ef8d6e0302200c

Download Submit
C:\Windows\System\XNfwDFN.exe

Filesize
2.3MB

MD5
44158d40f02ee06bc9a9100e70e188ee

SHA1
66a3bd677d39218a3067087ae56285eb069250b9

SHA256
5ba64af5f41fd43563a1031ff582f45ada2df2a2d987729a5862ff8a5c24f5b4

SHA512
b78a835c51bb6713cf6066eda97699e9bb2c7e25b1406478d84dea7432b9baf3e872fb9e1bd7d250b65d4f1e662280cfd401bfe7c83bc3c797873b91f6f0d6fb

Download Submit
C:\Windows\System\XYJbpeP.exe

Filesize
2.3MB

MD5
5516c1f8e13179587fd1b3d619db1fc6

SHA1
2f9209a35eae3ecdea52b8f3391fecc9f228cea3

SHA256
0e33f609982e6af0b87a503c696048c65d96822fcb5b92dc42b6f90f35d2a871

SHA512
79c329542f9df627ead803619e704e12e2bf33df5f18c649fb03c306b6460bfef03054c64e8a10de99a6e1099f1f13561899bf97462a8d8bf2648506aaf04517

Download Submit
C:\Windows\System\bMmeNfI.exe

Filesize
2.3MB

MD5
0f6e64f276155a2d0875a0f8dfd2af92

SHA1
f0ac1765d9c2ad006f9e6e50675e9fe59694e60f

SHA256
0f9406ed1a0798eff8f8e2b99abe07a20743f86de928e326c4f1cc0181508608

SHA512
96e3e9f963532de6f5a219b36b5fca10ba051df87654dc1cc96b853d00d15a2e78d78c15671c66a528d443e5a33ff5409aad86db753fda25ac9392ff6ba5367f

Download Submit
C:\Windows\System\cMBzwbg.exe

Filesize
2.3MB

MD5
3cfcc3a8121055d72460cf0ce1163641

SHA1
9bdf4a00aa47abc0612859c86a5f0f955d5aacac

SHA256
c7d2d1743a5486dd0e17f4d2e3c10d4d81ece6de7b1903c0d89c1aef14efa9dc

SHA512
864cd4b62bc51793abd537b773b73575d3f713758cad4a59bf8ed08154b37ac2515a54620090db741885c89fd106cb4d24f45f05affc5ce9c4cdb3b0b32e52be

Download Submit
C:\Windows\System\cdupsgL.exe

Filesize
2.3MB

MD5
d5a5dbcb65f7f1ee7d0d8b58a05d8657

SHA1
59725cca6f7f1483facede31a1cd34262b683f3f

SHA256
fa2d490cb58a5646e6a8e5399673fcd758b18486728ee6f8d123d6f4566314d1

SHA512
55db0d4e2d87f13da5a7223905ce6ee8fbd33cde80f4b068cb244b1c392c5b75902790e9e1b66b9e15248a7f66ecae3aeacdb103e49b4b838f878c4cd5051454

Download Submit
C:\Windows\System\ehfrjsx.exe

Filesize
2.3MB

MD5
9481496ab54ba92ba5b81f76c8d89843

SHA1
e630f9512711c7ee17dec0bb1814eccf4390e511

SHA256
51dd24f4a31e50f7e33cd594ae29be8e2b027b57519078cf10068af53ee9171b

SHA512
fdc7c6aacd3f271571ba8a1ab7b447f02c54a14a66dba27618900dd0243a1e38269f4f4e0e184a69cefdf0fa27504a21b74beab709f1029d2cff78db599415a3

Download Submit
C:\Windows\System\fwlTgCu.exe

Filesize
2.3MB

MD5
b6ce9aba3eabbf2374cf19774ef6a8e0

SHA1
527862c88e9bd71eb6f5a9c059e62bb12ea36a8d

SHA256
921e914652bb20586c147326bf44267f001d57afb73d4ac8297207855d4ebd06

SHA512
e74e41771b639e1891df6d0782d93d0f96da50d7be428f31b283d4d97150bd625b7bf1f4d2041e89f9b638545440e86f9752c3601d8bfc26ec301037d16cd211

Download Submit
C:\Windows\System\jJUBWwn.exe

Filesize
2.3MB

MD5
c67355af01885acf0cb8154a15b260bd

SHA1
ae91d0342d2810a6e21e4b9f096d370bba8478dc

SHA256
f822810ab1bb3fde792e664a560434f657e584a2d2f4b80ffcf2a0e5d10e5ffb

SHA512
b3657b1e8914bd9fb61466d0f87e901cc447f8f2cabfcf0884acd65e3a4f18d7a8709f3b97dd160ffc38928f8f0200d18a7464eb65c5ef5a9d628f783a4436b7

Download Submit
C:\Windows\System\lunSgst.exe

Filesize
2.3MB

MD5
e32a2cb7f3604fa8000364f3336d169c

SHA1
365d9283af710115f660ab9230cb7c94d9ad268c

SHA256
8760cf53d2710edd3b868ab343afe69f858549ba3ebfe579039d5714b66979c9

SHA512
b4d1262b7e96558cb103360bf59d193cb463c391f7af0f078266a74b8be7a0752cd874b0a6a2a6e1c54c06c0e90076cbdfa39bcabdb13229c60ba1312430ca7c

Download Submit
C:\Windows\System\oyloINq.exe

Filesize
2.3MB

MD5
2366424a8f11294becd9c2a7eadafb74

SHA1
dfae7fea501b3890c4a5f2a9623a0eea3cb266b0

SHA256
29a0bdd899b120122ddd45d0c76ad9df40476f3e15302ce2a92063942900dcb0

SHA512
c0213379ef7abfc844258047c44385c571b18005fe7ef2a10e910833981737ab0eb5bbe9e9b68a2af5a4ad5589860d4f273e5088a6dd4acc61e0182ea04d2274

Download Submit
C:\Windows\System\ozxplAR.exe

Filesize
2.3MB

MD5
39a282804b942215eb784dec3d7b9862

SHA1
05dee5e52da73adb34e0e6beece5452094ae7061

SHA256
ea5bf51f4c6261273014e8025ee0e4bd8b6b25752580deb25cc0cc35bc505241

SHA512
25632542bfe39d9a7988a6ccc09e637220421d786cc936bdd30f5bcf8d2641764eabbd52431821b01f4dd5b96e023ee2465a86cf54f0dfe56a8d345af55d9367

Download Submit
C:\Windows\System\rGVPwjZ.exe

Filesize
2.3MB

MD5
5fe3a455da3fa486a08522faa665efa9

SHA1
63ae62738aa2a9d97d5be65ea644c71b0021cd50

SHA256
8eb98c090d7aa20bd6079243020a983e8af44fcc2bf78c119dd351e504b2d395

SHA512
24db136fa65e2bb7e807c52961680c7c644428bf7b952b6a153b9d8e5f35d2c9fcf7ca9b052238ab5f4dbc93e34022ee21233bb3469601c55f76c2e62f2dcab3

Download Submit
C:\Windows\System\rbyGJVO.exe

Filesize
2.3MB

MD5
f5d4ec33cc6ce09249e6a23d708fc54c

SHA1
a3b5f57947d5584e8ed417d6e630ee94023adeea

SHA256
2326be0bc63a33cc3da831a21b31d0ede4b8d472db995931ad5ebb5191bae467

SHA512
eb8fe78d6975f2c4e55b651076757b829fed263fad9e094e8e623a99d7764a1010d9cd42ecc9b0009b0e1e7065e81025d73c41a316a7a7c1cd47001e64c237b6

Download Submit
C:\Windows\System\zRHlbFU.exe

Filesize
2.3MB

MD5
135e0c20282d3e0fa25bd9234950faa8

SHA1
6b656c44941e06412afd07c07aa08c962041c633

SHA256
af1dda74658d81b7eda42ef6554d84456a7fee16784e0bc1d7adf8ee239b4fa7

SHA512
0b61855c2ea0a76a71ff2229503899428e5b60e13c80ebb57f38cef16032074c8c0695ff4da78ba939507770f82e018ae3af218cd753233e7c5b1b0b59b959ee

Download Submit
memory/660-1-0x0000027105130000-0x0000027105140000-memory.dmp

Filesize
64KB

Download
memory/660-0-0x00007FF743E70000-0x00007FF7441C4000-memory.dmp

Filesize
3.3MB

Download
memory/744-686-0x00007FF79A690000-0x00007FF79A9E4000-memory.dmp

Filesize
3.3MB

Download
memory/744-2144-0x00007FF79A690000-0x00007FF79A9E4000-memory.dmp

Filesize
3.3MB

Download
memory/1132-770-0x00007FF7B3250000-0x00007FF7B35A4000-memory.dmp

Filesize
3.3MB

Download
memory/1132-2152-0x00007FF7B3250000-0x00007FF7B35A4000-memory.dmp

Filesize
3.3MB

Download
memory/1360-2141-0x00007FF630250000-0x00007FF6305A4000-memory.dmp

Filesize
3.3MB

Download
memory/1360-684-0x00007FF630250000-0x00007FF6305A4000-memory.dmp

Filesize
3.3MB

Download
memory/1428-722-0x00007FF6337F0000-0x00007FF633B44000-memory.dmp

Filesize
3.3MB

Download
memory/1428-2158-0x00007FF6337F0000-0x00007FF633B44000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2153-0x00007FF70CEA0000-0x00007FF70D1F4000-memory.dmp

Filesize
3.3MB

Download
memory/1492-747-0x00007FF70CEA0000-0x00007FF70D1F4000-memory.dmp

Filesize
3.3MB

Download
memory/1716-2148-0x00007FF698870000-0x00007FF698BC4000-memory.dmp

Filesize
3.3MB

Download
memory/1716-791-0x00007FF698870000-0x00007FF698BC4000-memory.dmp

Filesize
3.3MB

Download
memory/2012-704-0x00007FF71B7E0000-0x00007FF71BB34000-memory.dmp

Filesize
3.3MB

Download
memory/2012-2160-0x00007FF71B7E0000-0x00007FF71BB34000-memory.dmp

Filesize
3.3MB

Download
memory/2084-683-0x00007FF681BF0000-0x00007FF681F44000-memory.dmp

Filesize
3.3MB

Download
memory/2084-2137-0x00007FF681BF0000-0x00007FF681F44000-memory.dmp

Filesize
3.3MB

Download
memory/2136-759-0x00007FF71ECB0000-0x00007FF71F004000-memory.dmp

Filesize
3.3MB

Download
memory/2136-2151-0x00007FF71ECB0000-0x00007FF71F004000-memory.dmp

Filesize
3.3MB

Download
memory/2476-2134-0x00007FF7E2A40000-0x00007FF7E2D94000-memory.dmp

Filesize
3.3MB

Download
memory/2476-678-0x00007FF7E2A40000-0x00007FF7E2D94000-memory.dmp

Filesize
3.3MB

Download
memory/2876-688-0x00007FF746900000-0x00007FF746C54000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2161-0x00007FF746900000-0x00007FF746C54000-memory.dmp

Filesize
3.3MB

Download
memory/2944-742-0x00007FF6000E0000-0x00007FF600434000-memory.dmp

Filesize
3.3MB

Download
memory/2944-2155-0x00007FF6000E0000-0x00007FF600434000-memory.dmp

Filesize
3.3MB

Download
memory/2984-680-0x00007FF6718A0000-0x00007FF671BF4000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2138-0x00007FF6718A0000-0x00007FF671BF4000-memory.dmp

Filesize
3.3MB

Download
memory/3084-2149-0x00007FF746D20000-0x00007FF747074000-memory.dmp

Filesize
3.3MB

Download
memory/3084-786-0x00007FF746D20000-0x00007FF747074000-memory.dmp

Filesize
3.3MB

Download
memory/3120-802-0x00007FF66B3B0000-0x00007FF66B704000-memory.dmp

Filesize
3.3MB

Download
memory/3120-2135-0x00007FF66B3B0000-0x00007FF66B704000-memory.dmp

Filesize
3.3MB

Download
memory/3228-687-0x00007FF743610000-0x00007FF743964000-memory.dmp

Filesize
3.3MB

Download
memory/3228-2143-0x00007FF743610000-0x00007FF743964000-memory.dmp

Filesize
3.3MB

Download
memory/3448-2159-0x00007FF771ED0000-0x00007FF772224000-memory.dmp

Filesize
3.3MB

Download
memory/3448-714-0x00007FF771ED0000-0x00007FF772224000-memory.dmp

Filesize
3.3MB

Download
memory/3568-736-0x00007FF6B55E0000-0x00007FF6B5934000-memory.dmp

Filesize
3.3MB

Download
memory/3568-2157-0x00007FF6B55E0000-0x00007FF6B5934000-memory.dmp

Filesize
3.3MB

Download
memory/3724-795-0x00007FF727410000-0x00007FF727764000-memory.dmp

Filesize
3.3MB

Download
memory/3724-2147-0x00007FF727410000-0x00007FF727764000-memory.dmp

Filesize
3.3MB

Download
memory/3788-2142-0x00007FF78B780000-0x00007FF78BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3788-681-0x00007FF78B780000-0x00007FF78BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/4092-2140-0x00007FF7F9EE0000-0x00007FF7FA234000-memory.dmp

Filesize
3.3MB

Download
memory/4092-682-0x00007FF7F9EE0000-0x00007FF7FA234000-memory.dmp

Filesize
3.3MB

Download
memory/4200-2146-0x00007FF7E5D50000-0x00007FF7E60A4000-memory.dmp

Filesize
3.3MB

Download
memory/4200-711-0x00007FF7E5D50000-0x00007FF7E60A4000-memory.dmp

Filesize
3.3MB

Download
memory/4436-679-0x00007FF65E060000-0x00007FF65E3B4000-memory.dmp

Filesize
3.3MB

Download
memory/4436-2136-0x00007FF65E060000-0x00007FF65E3B4000-memory.dmp

Filesize
3.3MB

Download
memory/4452-740-0x00007FF776000000-0x00007FF776354000-memory.dmp

Filesize
3.3MB

Download
memory/4452-2156-0x00007FF776000000-0x00007FF776354000-memory.dmp

Filesize
3.3MB

Download
memory/4508-685-0x00007FF63BE80000-0x00007FF63C1D4000-memory.dmp

Filesize
3.3MB

Download
memory/4508-2139-0x00007FF63BE80000-0x00007FF63C1D4000-memory.dmp

Filesize
3.3MB

Download
memory/4552-729-0x00007FF6EBB90000-0x00007FF6EBEE4000-memory.dmp

Filesize
3.3MB

Download
memory/4552-2145-0x00007FF6EBB90000-0x00007FF6EBEE4000-memory.dmp

Filesize
3.3MB

Download
memory/4568-2154-0x00007FF6CF990000-0x00007FF6CFCE4000-memory.dmp

Filesize
3.3MB

Download
memory/4568-753-0x00007FF6CF990000-0x00007FF6CFCE4000-memory.dmp

Filesize
3.3MB

Download
memory/4584-698-0x00007FF63B3C0000-0x00007FF63B714000-memory.dmp

Filesize
3.3MB

Download
memory/4584-2162-0x00007FF63B3C0000-0x00007FF63B714000-memory.dmp

Filesize
3.3MB

Download
memory/4868-783-0x00007FF6D2B10000-0x00007FF6D2E64000-memory.dmp

Filesize
3.3MB

Download
memory/4868-2150-0x00007FF6D2B10000-0x00007FF6D2E64000-memory.dmp

Filesize
3.3MB

Download